The files the agents were trying to retrieve were all part of "Modern.Gov", a "proprietary agenda, committee-meeting, and governance-management product" made by Civica.

*Is it possible they were trying to use RubyGems to pivot to attacking government sites? * One of the diffs shows they were broadly scraping pages hosted by this .NET component.

I was unable to find any modern CVE for Civica.