A multi-year social engineering campaign nearly gave hackers a master key to the internet

Technology · Published 19 October 2026 · Updated 25 October 2026 Swipe more like this →

In short: In 2024, a backdoor was discovered in XZ Utils, a common compression tool. It wasn't a simple bug; it was a sophisticated, multi-year operation involving fake accounts and social engineering. This campaign nearly granted hackers a master key to millions of computers by secretly compromising critical networking utilities.

A CVSS rating of 10.0, representing maximum severity, was granted to the backdoor known as CVE-2024-3094. It allowed an attacker with a specific Ed448 private key to remotely execute code on affected systems via OpenSSH. The exploit was particularly dangerous because it targeted the SSH server daemon by abusing systemd, potentially granting full administrator access to systems running the compromised software.

The attack was the result of a long-term campaign starting in 2021 by a user named "Jia Tan." The perpetrator used "sock puppetry"—creating multiple fake accounts like "Jigar Kumar" and "misoeater91"—to pressure the original maintainer of XZ Utils. This social engineering effort eventually secured Tan the permissions needed to inject the malicious code into versions 5.6.0 and 5.6.1.

The technical execution was highly sophisticated. The malicious code remained dormant in the Git repository, only activating during the build process on specific x86-64 Linux systems using glibc and GCC. It worked by modifying a script called build-to-host.m4, which was only present in the tar files released by Tan, not in the public Git history. This allowed the exploit to replace an existing OpenSSH function with a malicious version.

While the backdoor was caught before widespread production deployment, the incident sparked a massive debate about the risks of critical cyberinfrastructure relying on unpaid volunteers. Security researchers have linked the operation to APT29, a group believed to work for the Russian Foreign Intelligence Service (SVR). The Open Source Security Foundation warned that this may not be an isolated incident, as similar social engineering tactics have targeted other major projects.

General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.

Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?

Related

• In 1988, a student's experiment accidentally crippled the early Internet, changing cybersecurity forever.
• A sophisticated supply chain attack compromised the core of Linux
• A single person with software mastery can now cripple the infrastructure of an entire nation.
• How a remote support tool became a gateway for state-sponsored hackers
• The first time malware physically destroyed heavy industrial machinery
• The AI pioneer who helped build the future now fears he lost control
• How a Beijing startup became the world's third-largest smartphone manufacturer in fifteen years
• Is Yuval Noah Harari a visionary historian or a purveyor of high-stakes infotainment?
• How a 1970s architecture became the backbone of modern global computing
• A zero-day exploit is a digital weapon that strikes before developers know it exists.
• Humanity hit eight billion in 2022, but our era of explosive growth is ending.
• How a Bootstrapped Indian Software Giant Became a Global Powerhouse Without Venture Capital

More in Technology today · More in Technology · Latest · A–Z · All topics