Cyberpediaby Brain
ENDEFR

The XZ Utils backdoor

In March 2024, malicious code is found in XZ Utils 5.6.0 and 5.6.1. What the CISA alert says, and what an employee can do.

In 30 seconds

Where it happens
In XZ Utils, a data compression tool that can be present in Linux distributions1.
What the malicious code can allow
Unauthorized access to affected systems, according to CISA1.
The reflex
Quickly report any abnormal system behavior to the IT or security team, and let the technical teams apply the official guidance.
If it has already happened
CISA recommends going back to an uncompromised version, such as XZ Utils 5.4.6 Stable, searching for any malicious activity, and reporting findings1.

What it is

In late March 2024, CISA said it was responding to reports of malicious code embedded in XZ Utils, a data compression tool. Versions 5.6.0 and 5.6.1 are affected, and the case was assigned the identifier CVE-2024-30941.

For an employee, this kind of incident has one particular feature: it does not come from a suspicious message or a fake website. It comes through legitimate software, installed or updated as usual. This entry describes what CISA published and what the MITRE ATT&CK reference pages say about this family of attacks. It does not cover how the attack was prepared or how it was discovered: the sources cited here do not contain that information.

Straight answers

What is XZ Utils?

It is a data compression tool. It can be present in Linux distributions1.

Which versions are affected?

Versions 5.6.0 and 5.6.1, in which malicious code was reported1. This activity carries the identifier CVE-2024-30941.

What does the malicious code allow?

According to CISA, it can allow unauthorized access to affected systems1.

What is a supply chain compromise?

MITRE ATT&CK defines it as the manipulation of products or their delivery mechanisms before they reach the final consumer, with the aim of compromising data or systems2.

What should an employee do?

If a machine behaves unusually, report it quickly. For its part, CISA asks developers and users to go back to an uncompromised version and to report what they find1. On a company-managed workstation, this rollback is a matter for the technical teams.

1Inside the attacker's head1 min

The sources cited here do not describe how this attack was prepared. It does describe the general logic of the family of attacks it belongs to.

MITRE ATT&CK lists supply chain compromise among the initial access techniques. It can happen at any stage: development tools, source code repositories, open source dependency code, update mechanisms, or replacement of legitimate software with a modified version2.

Open source projects widely used as dependencies by many applications can be targeted so that malicious code reaches everyone who uses them23. The attacker can target a specific set of victims, or distribute the software to a wide audience and follow up only with some victims24.

MITRE also describes the trusted relationship: actors who already have legitimate access, such as contractors, can be used as an entry point, because this access sometimes receives less scrutiny than ordinary entry routes6.

2What you see on screen1 min

CISA describes no sign visible to the user1. The text consulted therefore does not say what the update looks like to an employee, and this entry states nothing on the subject.

What the source allows is more limited: XZ Utils can be present in Linux distributions1.

3Under the hoodIT teams1 min

What CISA says about the mechanism comes down to a few words: malicious code is embedded in versions 5.6.0 and 5.6.1, and it can allow unauthorized access1.

MITRE ATT&CK places this type of action in two families of techniques:

  • Software supply chain compromise: manipulation of the application's source code, of its update or distribution mechanism, or replacement of compiled versions with a modified version4.
  • Modification of the authentication process: an attacker can modify the mechanisms that collect, store and validate credentials, for example pluggable authentication modules (PAM) on Unix-like systems. The attacker can then authenticate to a service without using a valid account5.

These two pages are general reference material. They do not mention XZ Utils, and nothing in the sources cited here ties this incident to a specific technique. The comparison is offered here as a way of reading the case, not as a finding.

4Case filesReal cases1 min

March 29, 2024: the CISA alert on XZ Utils

On March 29, 2024, CISA published an alert titled « Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094 ». It states that CISA and the open source community are responding to reports of malicious code embedded in XZ Utils, versions 5.6.0 and 5.6.11.

The text recalls that XZ Utils is a data compression tool, that it can be found in Linux distributions, and that the malicious code can allow unauthorized access to affected systems1.

CISA recommends that developers and users downgrade XZ Utils to an uncompromised version, such as XZ Utils 5.4.6 Stable, search for any malicious activity, and report any positive findings to CISA1. The alert also points to a Red Hat advisory concerning Fedora 41 and Rawhide1.

The sources cited here contain neither the timeline of how the attack was prepared, nor the names of the people involved, nor the circumstances of the discovery. These items therefore do not appear in this entry.

Fact sheet

Identifier
CP-179
Wing
2. Malware and case files
Brain skill
Incident Reporting & Response (report_incidents)
Brain reflex
cr-016
Diagram
G4 · Incident Timeline & Containment
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. CISA, “Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094”, 29 March 2024. https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094 (accessed 3 November 2026)
  2. MITRE ATT&CK, “Supply Chain Compromise”. https://attack.mitre.org/techniques/T1195/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Supply Chain Compromise: Compromise Software Dependencies and Development Tools”. https://attack.mitre.org/techniques/T1195/001/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Supply Chain Compromise: Compromise Software Supply Chain”. https://attack.mitre.org/techniques/T1195/002/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Modify Authentication Process”. https://attack.mitre.org/techniques/T1556/ (accessed 3 November 2026)
  6. MITRE ATT&CK, “Trusted Relationship”. https://attack.mitre.org/techniques/T1199/ (accessed 3 November 2026)

Cite this article

Brain, “The XZ Utils backdoor”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/xz-utils-backdoor-autopsy/

BibTeX 
@misc{brain_cp179_en_2026,
  author = {Brain},
  title = {The XZ Utils backdoor},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/xz-utils-backdoor-autopsy/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence