APT / THREAT GROUP

xzbot

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A backdoor brought into version 5.6.0 and 5.6.1 of compression library/tool xz/liblzma, which was intended to enable access via (Open)SSH on affected servers.

Threat Analysis

xzbot is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://boehs.org/node/everything-i-know-about-the-xz-backdoor

→https://gist.github.com/smx-smx/a6112d54777845d389bd7126d6e9f504

→https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27

→https://github.com/amlweems/xzbot

→https://github.com/karcherm/xz-malware

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

xzorcistsh.xzbotxzbot

External Intelligence

Malpedia: sh.xzbot

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search xzbot