XZ Utils

Reported Context (4)

Axios, Chalk, Debug, XZ Utils. What do all these open source projects have in common? Threat actors use social engineering to gain access to the legitimate project and pushed a new version containing malware. How Attackers Use Social Engineering to Target Open-Source Maintainers
Case Study I — XZ Utils (CVE-2024-3094): The Two-Year Patience Operation Supply-Chain Attacks Turn Security and DevSecOps Tools into Credential-Theft Paths
Merav’s pick – XZ Utils backdoor Wiz Recaps Notable Cloud Security Stories of 2024
A backdoor has been identified in versions 5.6.0 and 5.6.1 of XZ Utils (assigned CVE-2024-3094), which under some conditions may allow RCE via SSH authentication in specific versions of certain Linux distributions. XZ Utils Backdoor in Versions 5.6.0 and 5.6.1 Could Enable SSH-Based RCE

CVE (3)

People (15)

Threat Actors (6)

MITRE ATT&CK (24)

Vendors (6)

Products (35)

Tools (7)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.