Loading story…
A malicious backdoor was discovered in XZ Utils, a widely used compression library, and assigned CVE-2024-3094, raising urgent concerns about software supply chain compromise across Linux environments. The tampered code was introduced into upstream release tarballs for versions 5.6.0 and 5.6.1 and could enable unauthorized remote code execution by subverting authentication workflows in systems using affected liblzma packages, particularly where sshd was linked through systemd integrations. Security teams were urged to identify vulnerable builds, downgrade to trusted versions, and verify package provenance across development and production systems.
The incident renewed attention on the broader risk posed by foundational open-source components becoming attack vectors, echoing the long-tail impact of major infrastructure flaws such as CVE-2021-44228 in Apache Log4j. While unrelated technically, both cases underscored how deeply embedded dependencies can create outsized enterprise exposure when compromised. Organizations were advised to strengthen software bill of materials validation, monitor upstream package integrity, and accelerate patching and rollback procedures for critical third-party libraries.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Seqrite published details on Operation DRAGONCLONE, describing a campaign targeting a Chinese telecom organization using VELETRIX and VShell malware. No earlier date for the campaign activity is provided in the reference block.
Seqrite published analysis of AsukaStealer, describing it as a low-cost malware offering priced at $80 and highlighting the threat it posed to users' digital security. The reference does not provide an earlier event date beyond the publication date.
A supply-chain compromise in XZ Utils was publicly disclosed as CVE-2024-3094, triggering broad security concern over the backdoored compression library. The reference indicates this disclosure had already occurred by the time of Seqrite's April 2024 write-up.
Ubuntu published a security notice page for CVE-2021-44228, documenting the vulnerability in its security tracker. The provided reference does not include additional event timing beyond the page's publication date.
3 references tracked. Mallory keeps watching after this page renders.
ubuntu.com
Open sourceseqrite.com
Open sourceseqrite.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious supply-chain backdoor was discovered in **XZ Utils** versions `5.6.0` and `5.6.1`, tracked as **`CVE-2024-3094`**, after PostgreSQL developer and Microsoft engineer **Andres Freund** investigated unusual CPU behavior and traced it to `liblzma`. The tampering was hidden in release tarballs rather than plainly visible in the main Git repository, using an obfuscated **M4 macro** during the build process to generate second-stage artifacts that altered library behavior. Researchers and vendors said the poisoned build could interfere with **OpenSSH** authentication through `systemd`, creating a path for unauthorized remote access to affected Linux systems. Red Hat said **Red Hat Enterprise Linux** was not affected, but compromised packages reached **Fedora Rawhide** and **Fedora Linux 40 beta**, prompting urgent downgrade and rollback guidance to safe `5.4.x` releases; Fedora 40 reportedly did not show successful execution of the injected code. Reports also said the malicious build succeeded in **Debian unstable (Sid)**, appeared in a Debian beta branch, affected several **openSUSE** distributions, and was noted by **Kali Linux**, while stable Debian releases were not known to be impacted. The incident was widely described as a near-catastrophic attack on Linux infrastructure, with scrutiny falling on maintainer account **Jia Tan / JiaT75** and an apparent long-running social-engineering effort to gain influence over the project.
Jun 29, 2026
A malicious backdoor was discovered in **xz Utils**, a widely used compression library embedded in many Linux distributions, after software engineer **Andres Freund** investigated unusual performance issues tied to `ssh`. Researchers said the tampered release could have allowed attackers to hijack SSH authentication and execute code on affected machines, creating a stealthy compromise path into Linux servers and downstream infrastructure. The affected version had been published but was not yet broadly deployed, and maintainers moved quickly to issue fixes after the disclosure. Evidence cited by investigators indicates the attacker, operating under the pseudonym **"Jia Tan,"** spent years building credibility in the open-source project before gaining maintainer influence and inserting the backdoor, making the incident one of the most serious recent software supply-chain threats. The operation's sophistication prompted speculation that a nation-state actor may have been involved, and the case renewed concern over covert interception techniques resembling earlier reports of man-in-the-middle targeting of major internet services.
Jun 29, 2026
Debian issued **DSA 5649-1** for `xz-utils`, publishing a security update for the compression package in supported distributions. The advisory identified a vulnerability in `xz-utils` and directed users to install updated packages through Debian security channels to remediate the issue. Later disclosures about a **backdoor in certain XZ releases** prompted broader scrutiny across Unix-like systems, but FreeBSD said it was **not affected** by the malicious code found in those upstream releases. Together, the notices show parallel security activity around `xz-utils`: Debian distributing patched packages for its own tracked flaw, and FreeBSD confirming its exposure did not include the subsequently disclosed upstream backdoored versions.
Jun 29, 2026