---
id: CP-179
slug: xz-utils-backdoor-autopsy
lang: en
title: The XZ Utils backdoor
description: In March 2024, malicious code is found in XZ Utils 5.6.0 and 5.6.1. What the CISA alert says, and what an employee can do.
canonical_url: https://startbrain.io/cyberpedia/en/articles/xz-utils-backdoor-autopsy/
markdown_url: https://startbrain.io/cyberpedia/en/articles/xz-utils-backdoor-autopsy.md
publisher: Brain (https://startbrain.io)
license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)
cite_as: Brain, "The XZ Utils backdoor", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/xz-utils-backdoor-autopsy/ (CC BY 4.0)
wing: 2
theme: report_incidents
reflex: cr-016
schema: G4
updated: "2026-11-03"
translations:
  en: https://startbrain.io/cyberpedia/en/articles/xz-utils-backdoor-autopsy/
  fr: https://startbrain.io/cyberpedia/fr/articles/autopsie-xz-utils-backdoor/
  de: https://startbrain.io/cyberpedia/de/articles/autopsie-xz-utils-hintertur/
  es: https://startbrain.io/cyberpedia/es/articles/autopsia-xz-utils-puerta-trasera/
sources:
  - "n": 1
    title: Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094
    publisher: CISA
    url: https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
    published: "2024-03-29"
    accessed: "2026-11-03"
  - "n": 2
    title: Supply Chain Compromise
    publisher: MITRE ATT&CK
    url: https://attack.mitre.org/techniques/T1195/
    accessed: "2026-11-03"
  - "n": 3
    title: "Supply Chain Compromise: Compromise Software Dependencies and Development Tools"
    publisher: MITRE ATT&CK
    url: https://attack.mitre.org/techniques/T1195/001/
    accessed: "2026-11-03"
  - "n": 4
    title: "Supply Chain Compromise: Compromise Software Supply Chain"
    publisher: MITRE ATT&CK
    url: https://attack.mitre.org/techniques/T1195/002/
    accessed: "2026-11-03"
  - "n": 5
    title: Modify Authentication Process
    publisher: MITRE ATT&CK
    url: https://attack.mitre.org/techniques/T1556/
    accessed: "2026-11-03"
  - "n": 6
    title: Trusted Relationship
    publisher: MITRE ATT&CK
    url: https://attack.mitre.org/techniques/T1199/
    accessed: "2026-11-03"
---

# The XZ Utils backdoor

In late March 2024, CISA said it was responding to reports of malicious code embedded in XZ Utils, a data compression tool. Versions 5.6.0 and 5.6.1 are affected, and the case was assigned the identifier CVE-2024-3094 [1].

For an employee, this kind of incident has one particular feature: it does not come from a suspicious message or a fake website. It comes through legitimate software, installed or updated as usual. This entry describes what CISA published and what the MITRE ATT&CK reference pages say about this family of attacks. It does not cover how the attack was prepared or how it was discovered: the sources cited here do not contain that information.

## In 30 seconds

- Where it happens: in XZ Utils, a data compression tool that can be present in Linux distributions [1].
- What the malicious code can allow: unauthorized access to affected systems, according to CISA [1].
- The reflex: quickly report any abnormal system behavior to the IT or security team, and let the technical teams apply the official guidance.
- If it has already happened: CISA recommends going back to an uncompromised version, such as XZ Utils 5.4.6 Stable, searching for any malicious activity, and reporting findings [1].

## Straight answers

### What is XZ Utils?

It is a data compression tool. It can be present in Linux distributions [1].

### Which versions are affected?

Versions 5.6.0 and 5.6.1, in which malicious code was reported [1]. This activity carries the identifier CVE-2024-3094 [1].

### What does the malicious code allow?

According to CISA, it can allow unauthorized access to affected systems [1].

### What is a supply chain compromise?

MITRE ATT&CK defines it as the manipulation of products or their delivery mechanisms before they reach the final consumer, with the aim of compromising data or systems [2].

### What should an employee do?

If a machine behaves unusually, report it quickly. For its part, CISA asks developers and users to go back to an uncompromised version and to report what they find [1]. On a company-managed workstation, this rollback is a matter for the technical teams.

## Inside the attacker's head

The sources cited here do not describe how this attack was prepared. It does describe the general logic of the family of attacks it belongs to.

MITRE ATT&CK lists supply chain compromise among the initial access techniques. It can happen at any stage: development tools, source code repositories, open source dependency code, update mechanisms, or replacement of legitimate software with a modified version [2].

Open source projects widely used as dependencies by many applications can be targeted so that malicious code reaches everyone who uses them [2][3]. The attacker can target a specific set of victims, or distribute the software to a wide audience and follow up only with some victims [2][4].

MITRE also describes the trusted relationship: actors who already have legitimate access, such as contractors, can be used as an entry point, because this access sometimes receives less scrutiny than ordinary entry routes [6].

## What you see on screen

CISA describes no sign visible to the user [1]. The text consulted therefore does not say what the update looks like to an employee, and this entry states nothing on the subject.

What the source allows is more limited: XZ Utils can be present in Linux distributions [1].

## Under the hood

What CISA says about the mechanism comes down to a few words: malicious code is embedded in versions 5.6.0 and 5.6.1, and it can allow unauthorized access [1].

MITRE ATT&CK places this type of action in two families of techniques:

- Software supply chain compromise: manipulation of the application's source code, of its update or distribution mechanism, or replacement of compiled versions with a modified version [4].
- Modification of the authentication process: an attacker can modify the mechanisms that collect, store and validate credentials, for example pluggable authentication modules (PAM) on Unix-like systems. The attacker can then authenticate to a service without using a valid account [5].

These two pages are general reference material. They do not mention XZ Utils, and nothing in the sources cited here ties this incident to a specific technique. The comparison is offered here as a way of reading the case, not as a finding.

## Case files

### March 29, 2024: the CISA alert on XZ Utils

On March 29, 2024, CISA published an alert titled « Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094 ». It states that CISA and the open source community are responding to reports of malicious code embedded in XZ Utils, versions 5.6.0 and 5.6.1 [1].

The text recalls that XZ Utils is a data compression tool, that it can be found in Linux distributions, and that the malicious code can allow unauthorized access to affected systems [1].

CISA recommends that developers and users downgrade XZ Utils to an uncompromised version, such as XZ Utils 5.4.6 Stable, search for any malicious activity, and report any positive findings to CISA [1]. The alert also points to a Red Hat advisory concerning Fedora 41 and Rawhide [1].

The sources cited here contain neither the timeline of how the attack was prepared, nor the names of the people involved, nor the circumstances of the discovery. These items therefore do not appear in this entry.

## Sources

1. CISA, "Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094", 29 March 2024. https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 (accessed 3 November 2026)
2. MITRE ATT&CK, "Supply Chain Compromise". https://attack.mitre.org/techniques/T1195/ (accessed 3 November 2026)
3. MITRE ATT&CK, "Supply Chain Compromise: Compromise Software Dependencies and Development Tools". https://attack.mitre.org/techniques/T1195/001/ (accessed 3 November 2026)
4. MITRE ATT&CK, "Supply Chain Compromise: Compromise Software Supply Chain". https://attack.mitre.org/techniques/T1195/002/ (accessed 3 November 2026)
5. MITRE ATT&CK, "Modify Authentication Process". https://attack.mitre.org/techniques/T1556/ (accessed 3 November 2026)
6. MITRE ATT&CK, "Trusted Relationship". https://attack.mitre.org/techniques/T1199/ (accessed 3 November 2026)

---

Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/xz-utils-backdoor-autopsy/
You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.