36-Month Precision Supply Chain Campaign Targeting DevSecOps Infrastructure (CVE-2024-3094, CVE-2025-30066, CVE-2025-30154)
36-Month Precision Supply Chain Campaign Targeting DevSecOps (TL-2026-0310), also tracked as Operation Scanner Weapon, is a critical-severity supply-chain compromise scored CVSS 10, first published 2026-04-01. It is attributed to JiaT75 (China) with low confidence, affects Tukaani XZ Utils, references 3 CVEs (CVE-2024-3094, CVE-2025-30066, CVE-2025-30154), maps to 18 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0310
- Threat ID
- TL-2026-0310
- Also known as
- Operation Scanner Weapon, DevSecOps Supply Chain Campaign 2024-2026
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-04-01
- Last reviewed
- 2026-04-01
- Attribution
- JiaT75
- Attribution confidence
- LOW
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- technology, government, financial, healthcare, defense, cloud-infrastructure, devops, cybersecurity
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in 36-Month Precision Supply Chain Campaign Targeting DevSecOps
Malware and tooling: Internet Computer (ICP) Blockchain via DFINITY
A systematic 36-month supply chain attack campaign (2024-2026) targeting DevSecOps tools including XZ Utils (CVE-2024-3094, CVSS 10.0), tj-actions/changed-files (CVE-2025-30066), reviewdog (CVE-2025-30154), Trivy/Aqua Security GitHub Actions, and litellm PyPI package. Attackers compromised trusted security scanners, CI/CD pipelines, and open-source dependencies using social engineering, tag poisoning, and credential harvesting, affecting 23,000+ repositories with blockchain-based C2 infrastructure.
How 36-Month Precision Supply Chain Campaign Targeting DevSecOps works
This threat profile documents a coordinated multi-year supply chain campaign spanning from October 2021 to March 2026, systematically targeting DevSecOps infrastructure — the very tools defenders rely on to secure their software supply chains.
The campaign exhibits a striking "March pattern" with major incidents clustering in Q1: XZ Utils discovery on March 28, 2024; tj-actions/reviewdog compromise on March 14, 2025; and Trivy/litellm incidents within a 5-day window on March 19-24, 2026. This temporal clustering exploits peak Q1 release cycle pressure, maintainer conference travel (RSA, KubeCon EU), and elevated enterprise deployment rates.
CASE STUDY 1 — XZ UTILS BACKDOOR (CVE-2024-3094, CVSS 10.0): The most sophisticated incident began in October 2021 when threat actor "JiaT75" (Jia Tan) created a GitHub account and began contributing to the XZ Utils project. Over 30+ months, the actor built legitimate credibility through quality contributions. Coordinated pressure from sock puppet accounts "Jigar Kumar" and "Hans Jansen" accelerated the maintainer's willingness to grant commit access in January 2023. In February 2024, the actor injected a backdoor via binary test files (tests/files/bad-3-corrupt_lzma2.xz, tests/files/good-large_compressed.lzma) that used tr utility de-obfuscation to extract a precompiled object file during the liblzma build process. The payload hooked RSA_public_decrypt to compromise SSH authentication on x86_64 systems with systemd. The backdoor was discovered on March 28, 2024 by Microsoft engineer Andres Freund through SSH performance anomalies. Affected versions: XZ Utils 5.6.0 and 5.6.1.
CASE STUDY 2 — TJ-ACTIONS/REVIEWDOG (CVE-2025-30066, CVE-2025-30154): On March 11, 2025, the reviewdog/action-setup GitHub Action was compromised when attacker "hackerbot-claw" exploited GitHub's automated team invitation system based on activity thresholds, receiving write access to the @reviewdog/actions-maintainer team. The attacker pushed malicious commits and redirected the v1 tag, creating a transitive dependency chain: reviewdog/action-setup → reviewdog/action-typos → tj-actions/eslint-changed-files → tj-actions/changed-files. On March 14-15, 2025, tj-actions/changed-files tags v1 through v45.0.7 were pointed to malicious commit 0e58ed8. The payload executed a Python script performing /proc/{PID}/mem memory scraping of Runner.Worker, Runner.Listener, runsvc, and run.sh processes to extract GitHub Actions secret JSON structures. Secrets were exfiltrated via public CI workflow logs, bypassing GitHub's log masking layer which operates at a different abstraction level. Over 23,000 repositories were affected. Both CVEs were added to CISA's Known Exploited Vulnerabilities catalog.
CASE STUDY 3 — TRIVY/AQUA SECURITY GITHUB ACTIONS (MARCH 2026): This attack proceeded in three waves. Wave 1 (late February 2026): The attacker exploited a pull_request_target workflow vulnerability in Aqua Security's GitHub Actions, executing base branch workflows with full secret scope to extract a privileged Personal Access Token. Wave 2 (March 1-19, 2026): After public disclosure, Aqua Security performed credential rotation but critically overlooked the aqua-bot service account token, which retained release-signing permissions, providing 18 days of undetected residual access. Wave 3 (March 19, 2026, 17:43 UTC): The attacker force-pushed 76 of 77 trivy-action version tags and all 7 setup-trivy tags to malicious commit e0198fd2b6e1679e36d32933941182d9afa82f6f (unreachable from master). Simultaneously, trivy v0.69.4 was published through compromised release automation. The malicious entrypoint.sh grew from 2,855 bytes to 17,592 bytes (6.16x increase), containing a 105-line credential sweep block that executed before the legitimate scanner. On GitHub-hosted runners, it performed process memory scraping identical to the tj-actions technique. On self-hosted runners, it conducted broad filesystem sweeps targeting SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configs, Terraform state, Helm secrets, and cryptocurrency wallet files. Credentials were encrypted with AES-256-CBC and RSA-4096 session key wrapping, then exfiltrated to blockchain-based C2 infrastructure on the Internet Computer (ICP) network at tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io. A fallback exfiltration channel used GitHub releases in an attacker-created "tpcp-docs" repository.
CASE STUDY 4 — LITELLM PYPI PACKAGE (MARCH 2026): Five days after the Trivy incident, on March 24, 2026, malicious litellm packages v1.82.7 and v1.82.8 were published directly to PyPI, bypassing the GitHub release pipeline entirely. The attack used Python .pth file auto-execution (litellm_init.pth) to run code on every Python interpreter startup. The payload created fork bomb child processes via subprocess.Popen, performed filesystem credential sweeps identical to the Trivy attack, encrypted exfiltrated data with AES-256-CBC + RSA-4096, and sent it to typosquatted domain models.litellm.cloud via HTTPS POST. In Kubernetes environments, the payload enumerated cluster secrets across all namespaces and created privileged pods in kube-system with host filesystem mounts for container escape. Persistence was established via ~/.config/systemd/user/sysmon.service.
SHARED TOOLKIT INDICATORS: The Trivy and litellm incidents share identical persistence patterns (~/.config/sysmon.py naming), identical encryption (AES-256-CBC + RSA-4096), identical IMDS metadata harvesting, and occurred within a 5-day window, strongly suggesting a shared toolkit or unified threat actor.
BLOCKCHAIN C2 INNOVATION: The use of Internet Computer (ICP) blockchain for C2 infrastructure represents a significant evolution. The tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io domain is censorship-resistant by design — there is no registrar, DNS operator, hosting provider, or abuse@ takedown path. Mitigation is limited to network-layer blocking via BGP null-route or perimeter domain blocking of *.icp0.io domains.
KEY INSIGHT: As CloudSEK notes: "The most systematically targeted software in the software supply chain has been security software itself." Aqua Security's own supply chain was compromised in ways its own tooling did not detect; the compromise was discovered through behavioral anomalies detected by CrowdStrike, not security scanning.
MITRE ATT&CK techniques used in TL-2026-0310
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
execution
T1059 Command and Scripting Interpreter
persistence
T1098 Account Manipulation; T1543 Create or Modify System Process; T1554 Compromise Host Software Binary
command-and-control
initial-access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
credential-access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1556 Modify Authentication Process
privilege-escalation
T1546 Event Triggered Execution; T1611 Escape to Host
resource-development
Affected products and versions in 36-Month Precision Supply Chain Campaign Targeting DevSecOps
- Tukaani — XZ Utils
Vulnerable versions: 5.6.0; 5.6.1
Fixed in: < 5.6.0 - tj-actions — changed-files
Vulnerable versions: v1 through v45.0.7
Fixed in: v46+ - reviewdog — action-setup
Vulnerable versions: v1 (all versions)
Fixed in: Pin to verified commit SHA - reviewdog — action-ast-grep
Vulnerable versions: < 1.26.2
Fixed in: 1.26.2 - reviewdog — action-shellcheck
Vulnerable versions: < 1.29.2
Fixed in: 1.29.2 - reviewdog — action-staticcheck
Vulnerable versions: < 1.26.2
Fixed in: 1.26.2 - reviewdog — action-typos
Vulnerable versions: < 1.17.2
Fixed in: 1.17.2 - Aqua Security — trivy-action
Vulnerable versions: 76 of 77 tags poisoned
Fixed in: Pin to verified commit SHA - Aqua Security — setup-trivy
Vulnerable versions: All 7 tags poisoned
Fixed in: Pin to verified commit SHA - Aqua Security — Trivy
Vulnerable versions: v0.69.4 (malicious binary)
Fixed in: Any version != v0.69.4
Remediation for 36-Month Precision Supply Chain Campaign Targeting DevSecOps
Patches
- XZ Utils: Downgrade to version < 5.6.0
- tj-actions/changed-files: Update to v46 or later
- reviewdog/action-setup: Pin to verified commit SHA
- reviewdog/action-ast-grep: Update to >= 1.26.2
- reviewdog/action-composite-template: Update to >= 0.20.2
- reviewdog/action-shellcheck: Update to >= 1.29.2
- reviewdog/action-staticcheck: Update to >= 1.26.2
- reviewdog/action-typos: Update to >= 1.17.2
- litellm: Remove v1.82.7/v1.82.8, reinstall from verified source
Immediate actions
- Pin all GitHub Actions to specific commit SHAs, not tags
- Block *.icp0.io and *.ic0.app egress at network perimeter and CI runner subnets
- Block scan.aquasecurtiy.org and models.litellm.cloud at DNS/firewall
- Revert XZ Utils to versions prior to 5.6.0
- Uninstall litellm PyPI packages v1.82.7 and v1.82.8
- Rotate all GitHub Actions runner tokens and CI/CD secrets
- Audit for ~/.config/sysmon.py and ~/.config/systemd/user/sysmon.service persistence artifacts
- Revert Trivy action references to signed commit SHAs
Workarounds
- Verify all GitHub Action tag references against commit SHA before deployment
- Use hash-pinned dependencies exclusively in CI/CD pipelines
- Implement allowlist-based egress filtering on CI/CD runners
- Audit Kubernetes RBAC for unauthorized privileged pod creation in kube-system
Longer-term hardening
- Implement entrypoint.sh file size baseline monitoring with alerts on >50% deviation
- Monitor for dangling commits unreachable from base branch in GitHub repositories
- Implement pull_request trigger instead of pull_request_target in GitHub Actions
- Audit all bot tokens before human PAT rotation during incident response
- Require signed release provenance attestations via Sigstore for all dependencies
- Implement 90-day bot token rotation policy
- Deploy DNS query logging on CI runners to detect blockchain domain egress
- Monitor Python dependency lockfiles for package versions lacking corresponding GitHub release tags
- Implement novel token/subnet/repo triple detection for git push events
CVEs associated with 36-Month Precision Supply Chain Campaign Targeting DevSecOps
Weaknesses (CWE) in 36-Month Precision Supply Chain Campaign Targeting DevSecOps
CWE-506
Timeline of 36-Month Precision Supply Chain Campaign Targeting DevSecOps
- Threat actor JiaT75 (Jia Tan) creates GitHub account, begins contributing to XZ Utils project
- JiaT75 submits first malicious commit to XZ Utils, beginning 30+ month credibility campaign
- Coordinated pressure campaign via sock puppet accounts Jigar Kumar and Hans Jansen to accelerate XZ Utils review cycles
- JiaT75 granted commit access to XZ Utils after sustained quality contributions and social pressure
- Malicious payload injected into XZ Utils via binary test files (bad-3-corrupt_lzma2.xz, good-large_compressed.lzma), compromising liblzma build
- Microsoft engineer Andres Freund discovers XZ Utils backdoor (CVE-2024-3094, CVSS 10.0) through SSH performance anomalies
- CISA issues alert for CVE-2024-3094, XZ Utils versions 5.6.0 and 5.6.1 confirmed affected
- reviewdog/action-setup GitHub Action compromised (CVE-2025-30154) via automated team invitation exploitation by hackerbot-claw
- tj-actions/changed-files tags v1-v45.0.7 redirected to malicious commit 0e58ed8 (CVE-2025-30066), affecting 23,000+ repositories
- CISA adds CVE-2025-30066 to Known Exploited Vulnerabilities catalog
- CISA adds CVE-2025-30154 to Known Exploited Vulnerabilities catalog
- Wave 1: Attacker exploits pull_request_target workflow in Aqua Security GitHub Actions, extracts privileged PAT
- Trivy compromise publicly disclosed; Aqua Security performs incomplete credential rotation, missing aqua-bot service account token
- Wave 3: 76/77 trivy-action tags and all 7 setup-trivy tags force-pushed to malicious commit e0198fd; trivy v0.69.4 binary backdoored; blockchain C2 deployed
- Malicious litellm v1.82.7 and v1.82.8 published to PyPI via direct maintainer credential theft, bypassing GitHub release pipeline
- CloudSEK publishes comprehensive analysis linking all incidents as systematic 36-month DevSecOps supply chain campaign
- As of 2026-05-29, still active: the 3 CVEs are patched (XZ <5.6.0, tj-actions v46, Trivy tags restored), but the actor behind the 2026 wave (TeamPCP/UNC6780) is uncontained and escalating, breaching GitHub's own infra via a poisoned Nx Console extension on May 18-20 and selling 3,800 repos. The record's CONTAINED status is now outdated.
Sources cited for 36-Month Precision Supply Chain Campaign Targeting DevSecOps
- CloudSEK: The Scanner Was the Weapon — 36 Months of Precision Supply Chain Attacks Against DevSecOps Infrastructure
- NVD - CVE-2024-3094
- NVD - CVE-2025-30066
- NVD - CVE-2025-30154
- CISA Alert — XZ Utils Backdoor (CVE-2024-3094)
- CISA KEV — CVE-2025-30066 tj-actions/changed-files
- CISA KEV — CVE-2025-30154 reviewdog/action-setup
- GitHub Security Advisory — reviewdog/action-setup (GHSA-qmg3-hpqr-gqvc)
- Andres Freund — XZ Utils Backdoor Discovery (oss-security)
- StepSecurity — tj-actions Supply Chain Attack Analysis
- Wiz — reviewdog/action-setup Supply Chain Compromise
- Sysdig — Analysis of tj-actions/changed-files Attack
Threats related to 36-Month Precision Supply Chain Campaign Targeting DevSecOps
- TeamPCP Partners With Vect Ransomware Group to Escalate Cross-Ecosystem Open Source Supply Chain Attacks
- TeamPCP Supply Chain Campaign: LiteLLM PyPI Compromise, CanisterWorm npm Propagation, and Multi-Ecosystem Attack (CVE-2026-33634)
- TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payload
- LiteLLM Supply Chain Compromise — TeamPCP Multi-Ecosystem Campaign via Trojanized PyPI Packages
- Trivy Supply Chain Compromise — TeamPCP Credential-Stealing Malware Injected into CI/CD Pipelines (CVE-2026-33634)
- Supply Chain Attacks on Crypto Ecosystem via Developer Toolchain Compromise
Detection coverage for TL-2026-0310
As of 2026-04-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0310 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.