XZ Utils backdoor

T0111 · Resource Development · Malicious code contribution to an open-source repository

The attacker spent years contributing legitimate-looking patches and
pressure on the original maintainer until they obtained release rights.

T0138 · Persistence · Backdoor in code

Malicious code was introduced into the xz tarball via obfuscated test
files and build-script glue rather than a readable source change.

T0198 · Defense Evasion · Malicious Build Time Dependencies

The payload assembled at build time from binary test blobs, which
source-oriented SBOM and review workflows missed.

T0191 · Impact · Malicious code in artifacts

Released tarballs 5.6.0/5.6.1 contained the backdoor; git checkout
alone did not always match the published artifacts.

T0170 · Defense Evasion · Malicious compiler or interpreter

IFUNC resolvers and the build toolchain were abused so the backdoor
only fully appeared in the linked sshd binary.

T0150 · Execution · Runtime logic bomb

The backdoor armed only in specific builds (systemd-linked sshd) and
stayed inert in others — a selective runtime trigger.

T0172 · Execution · Runtime backdoor

Compromised liblzma would have given the operator a silent pre-auth
hook in sshd on affected systemd builds.

T0201 · Impact · Customers compromised

Any distro or product that consumed the backdoored tarball would have
shipped a compromised SSH stack to its users.