On March 29, 2024, a Microsoft engineer named Andres Freund posted to the Oss-security mailing list. He had been running some microbenchmarks and noticed that SSH logins on his Debian system were consuming 500ms of CPU time more than expected. After some investigation, he found that the excess CPU usage traced back to a backdoor embedded in XZ Utils versions 5.6.0 and 5.6.1 - compression library software present in virtually every Linux distribution on the internet. Freund had stumbled onto what CISA later described as one of the most sophisticated supply chain attacks ever discovered.
XZ Utils: Background
XZ Utils is a lossless data compression library and command-line tool. It's not well known outside of systems programming, but it's present everywhere: most Linux distributions use it to compress packages, kernel images, and system files. liblzma, the underlying library, is linked into thousands of applications including systemd - the initialization and service manager used by most modern Linux systems.
The primary maintainer of XZ Utils was Lasse Collin, who had maintained the project since its inception. By 2022, Collin was overwhelmed. The project was understaffed, the mailing list was full of complaints about slow releases, and Collin had acknowledged health issues. Into this environment appeared a new contributor named Jia Tan.
The Social Engineering Campaign
The operation targeting XZ Utils began approximately two years before the backdoor was discovered. Jia Tan (GitHub handle JiaT75) began submitting patches to the project in 2021 - good patches, genuinely improving the codebase. Simultaneously, a separate persona named Jigar Kumar began posting to the mailing list, complaining about slow development pace and expressing concern about maintainer burnout. A third account, Dennis Ens, joined in expressing similar concerns and suggesting that perhaps new contributors like Jia Tan should be given more responsibility.
Whether Kumar and Ens were operated by the same person as Jia Tan, or by separate handlers coordinating pressure on the project, has not been confirmed. What the pattern clearly represents is a coordinated social engineering operation: manufacturing pressure on the maintainer to delegate trust to the planted contributor.
Over roughly two years, Jia Tan accumulated trust. Good commits, responsive engagement, professionalism. By the end of 2023, Tan had been granted commit access and was effectively co-maintaining the project. Collin, dealing with health issues and development pressure, had stepped back.
The Backdoor: Technical Details
The malicious code was introduced in XZ Utils versions 5.6.0 (February 2024) and 5.6.1 (March 2024). The backdoor was not in the primary source code - it was hidden in the build system, specifically in the autoconf/automake generated test files included in the distribution tarball but not in the git repository. This meant that looking at the git history would not reveal the backdoor; you had to examine the distributed release packages.
The mechanism was sophisticated. The malicious code modified the build process to inject a payload into liblzma. On affected systems running systemd (which links liblzma for lzma-compressed journal support), the library was loaded into the address space of the SSH daemon (sshd). The backdoor intercepted RSA key authentication operations in sshd.
The backdoor's function: when a connection arrived at sshd with a specially crafted RSA public key controlled by the attackers, the backdoor would extract a payload from the key, decrypt it using a hardcoded Ed448 private key, and execute it with the privileges of the sshd process - typically root. The victim would never see an authentication failure or log entry. The backdoor was essentially a passive listener for a magic public key that would trigger arbitrary code execution.
The Narrow Miss
XZ Utils 5.6.0 was released in February 2024. Several rolling-release distributions - Arch Linux, Gentoo - shipped it within weeks. Debian testing/unstable and Fedora Rawhide included the compromised versions. Fedora 40 was in beta with 5.6.0 before the discovery; Red Hat issued an emergency advisory.
The attack was not detected by any automated tooling, code review process, or security audit. It was detected by a single engineer noticing an anomalous CPU measurement during performance benchmarking and following the trail. Had Freund not been running those microbenchmarks - had the SSH performance impact been smaller, or had the target been a distribution with less testing - the backdoor might have shipped in stable releases across the Linux ecosystem.
Stable releases of major distributions - Ubuntu LTS, Debian stable, Red Hat Enterprise Linux - had not yet included the affected versions at the time of discovery. The affected versions were present in testing and rolling-release channels. The timeline suggests the attacker may have been planning for a longer window before the backdoor reached stable production systems.
Attribution
Attribution has not been officially confirmed, but the technical and operational characteristics point clearly toward a sophisticated nation-state intelligence operation. The most commonly cited candidate is a Chinese intelligence service, given the code patterns, the nature of the targeting (SSH access to Linux infrastructure globally), and the two-year patience of the social engineering operation.
Researcher analysis of Jia Tan's timezone and work patterns based on commit timestamps suggests activity primarily in UTC+8 (China Standard Time), with a pattern consistent with someone working business hours in China or East Asia. The sophistication of the backdoor implementation, the use of multiple personas for social pressure, and the target selection all fit a well-resourced state intelligence operation.
The Jia Tan GitHub account (JiaT75) was created in 2021 specifically for this operation and has no other significant activity. The account was likely purpose-built for the XZ campaign.
Implications for Open Source Security
The XZ attack exposed a structural vulnerability in the open source ecosystem: critical infrastructure software is often maintained by single individuals who are overworked, underfunded, and vulnerable to social engineering through manufactured community pressure. Lasse Collin was not negligent; he was overwhelmed, and he made reasonable decisions based on a contributor who had spent two years demonstrating genuine technical competence.
The attack also demonstrated that sophisticated actors are willing to invest years of effort to compromise a single component of the software supply chain - not for immediate exploitation, but to create a persistent capability for future use. The XZ backdoor would have given the attacker SSH root access to any server running the compromised library, potentially including government and military infrastructure globally.
Responses to the discovery included calls for reproducible builds (making it possible to verify that a distributed binary matches the source code), improved funding for critical open source maintainers, and tooling to detect suspicious patterns in contributor activity. The OpenSSF (Open Source Security Foundation) accelerated several initiatives. CISA issued guidance. The European Commission's Cyber Resilience Act explicitly addresses open source component security.
Whether the attacker behind JiaT75 tried again under a different identity is unknown. The operation's discovery means the specific approach - compromised test files in distribution tarballs - is now documented and monitored. But the structural condition that made it possible - individual maintainers under pressure, no formal trust verification for commit access, distribution tarballs not reproducible from source - remains largely unchanged.