Loading threat actor…
Jia Tan is the persona associated with the 2024 XZ Utils software supply-chain compromise that introduced the liblzma backdoor tracked as CVE-2024-3094. The operation is notable for a long-term trust-building campaign in a widely used open-source project, followed by insertion of a highly selective backdoor into release artifacts rather than a straightforward source-level implant. The persona operated through the GitHub handle JiaT75 and spent more than two years making legitimate-seeming contributions before obtaining commit access to the project in January 2023. The compromise targeted the XZ Utils compression library and, through downstream Linux distribution integration, affected environments where liblzma could be loaded into SSH authentication paths. The malicious functionality was introduced through obfuscated build-time logic and crafted test-file artifacts that caused a precompiled object to be injected into liblzma during packaging-oriented builds. The resulting implant interfered with SSH public-key authentication by hooking cryptographic function resolution inside sshd, but only under narrow conditions including specific architecture and systemd-linked environments. The backdoor was intentionally fragile and environment-aware, with activation dependent on distribution packaging context and indirect loading paths, reflecting strong defense-evasion tradecraft. The broader operation also involved social engineering against project governance. Additional personas, including Jigar Kumar and Hans Jansen, were used to pressure maintainer Lasse Collin to accelerate patch acceptance and shift maintenance responsibility toward Jia Tan. Reporting and expert commentary have characterized the campaign as unusually sophisticated and consistent with a deliberate, patient software supply-chain intrusion. Public discussion has raised the possibility of nation-state involvement, but attribution to a specific state or country remains unconfirmed at high confidence. Jia Tan’s known behavior in this incident demonstrates initial access through maintainer infiltration, persistence through trusted project participation and commit rights, defense evasion through obfuscation and environment-gated activation, and post-exploitation capability aimed at covertly subverting authentication in downstream systems. The actor is best understood as a supply-chain threat persona tied to one of the most significant open-source backdoor attempts publicly disclosed in recent years.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducted a long-term supply chain compromise of XZ Utils by building trust as a legitimate contributor, using coordinated social pressure via additional personas, and ultimately inserting a backdoor into release artifacts that affected SSH authentication on targeted Linux environments.
Suspected of being a nation-state hacker who inserted a backdoor into the open-source XZ Utils software, potentially enabling unauthorized access to systems using the utility.
Suspected malicious contributor who spent ~2 years gaining trust in the XZ/LZMA project, then introduced an obfuscated supply-chain backdoor into liblzma (XZ Utils) that could be indirectly loaded by distro-patched OpenSSH/sshd builds (e.g., systemd integration), enabling covert access under specific build/runtime conditions and with anti-analysis/trigger logic.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.