GemStuffer
Named by 5 kept items in this workspace.
3 items name it under classification.key entities and 2 under threat actors.
Search every workspace for GemStuffer. It matches the name as written, so it can find other things that share it.
The items that name it 5
RubyGems campaign (originally found by Socket, ~May) using gem publishing to hide/exfiltrate stolen data, reportedly targeting UK government; 2,539 new copycat threat reports found resembling it, though payloads not confirmed in the new wave.
RubyGems campaign using more than 100 (tracked at 155 package artifacts) gems as a data exfiltration/transport mechanism, scraping UK local government democratic services portals and packaging the responses into .gem archives published to RubyGems from newly created accounts using hardcoded API keys
All threat actors in this workspace.