APT / THREAT GROUP

xzbot

Internal ID: sh.xzbot

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A backdoor brought into version 5.6.0 and 5.6.1 of compression library/tool xz/liblzma, which was intended to enable access via (Open)SSH on affected servers.

Threat Analysis

xzbot is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://boehs.org/node/everything-i-know-about-the-xz-backdoor

→https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9f504

→https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

→https://github.com/amlweems/xzbot

→https://github.com/karcherm/xz-malware

→https://gynvael.coldwind.pl/?lang=en&id=782

→https://medium.com/@DCSO_CyTec/xz-backdoor-how-to-check-if-your-systems-are-affected-fb169b638271

→https://twitter.com/fr0gger_/status/1774342248437813525

→https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094

→https://www.linkedin.com/posts/threatmon_xz-utils-backdoor-cve-2024-3094-activity-7181228442791641088-rw2a?utm_source=share&utm_medium=member_desktop

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

sh.xzbot

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search xzbot