# 36-Month Precision Supply Chain Campaign Targeting DevSecOps Infrastructure (CVE-2024-3094, CVE-2025-30066, CVE-2025-30154)

> A systematic 36-month supply chain attack campaign (2024-2026) targeting DevSecOps tools including XZ Utils (CVE-2024-3094, CVSS 10.0), tj-actions/changed-files (CVE-2025-30066), reviewdog (CVE-2025-30154), Trivy/Aqua Security GitHub Actions, and litellm PyPI package. Attackers compromised trusted security scanners, CI/CD pipelines, and open-source dependencies using social engineering, tag poisoning, and credential harvesting, affecting 23,000+ repositories with blockchain-based C2 infrastructure.

- **Published:** 2026-04-01T12:00:00Z
- **Last reviewed:** 2026-04-01T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0310
- **ID:** TL-2026-0310
- **Severity:** CRITICAL (CVSS 10)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** JiaT75 (China)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-3094, CVE-2025-30066, CVE-2025-30154

## Description

This threat profile documents a coordinated multi-year supply chain campaign spanning from October 2021 to March 2026, systematically targeting DevSecOps infrastructure — the very tools defenders rely on to secure their software supply chains.

The campaign exhibits a striking "March pattern" with major incidents clustering in Q1: XZ Utils discovery on March 28, 2024; tj-actions/reviewdog compromise on March 14, 2025; and Trivy/litellm incidents within a 5-day window on March 19-24, 2026. This temporal clustering exploits peak Q1 release cycle pressure, maintainer conference travel (RSA, KubeCon EU), and elevated enterprise deployment rates.

CASE STUDY 1 — XZ UTILS BACKDOOR (CVE-2024-3094, CVSS 10.0):
The most sophisticated incident began in October 2021 when threat actor "JiaT75" (Jia Tan) created a GitHub account and began contributing to the XZ Utils project. Over 30+ months, the actor built legitimate credibility through quality contributions. Coordinated pressure from sock puppet accounts "Jigar Kumar" and "Hans Jansen" accelerated the maintainer's willingness to grant commit access in January 2023. In February 2024, the actor injected a backdoor via binary test files (tests/files/bad-3-corrupt_lzma2.xz, tests/files/good-large_compressed.lzma) that used tr utility de-obfuscation to extract a precompiled object file during the liblzma build process. The payload hooked RSA_public_decrypt to compromise SSH authentication on x86_64 systems with systemd. The backdoor was discovered on March 28, 2024 by Microsoft engineer Andres Freund through SSH performance anomalies. Affected versions: XZ Utils 5.6.0 and 5.6.1.

CASE STUDY 2 — TJ-ACTIONS/REVIEWDOG (CVE-2025-30066, CVE-2025-30154):
On March 11, 2025, the reviewdog/action-setup GitHub Action was compromised when attacker "hackerbot-claw" exploited GitHub's automated team invitation system based on activity thresholds, receiving write access to the @reviewdog/actions-maintainer team. The attacker pushed malicious commits and redirected the v1 tag, creating a transitive dependency chain: reviewdog/action-setup → reviewdog/action-typos → tj-actions/eslint-changed-files → tj-actions/changed-files. On March 14-15, 2025, tj-actions/changed-files tags v1 through v45.0.7 were pointed to malicious commit 0e58ed8. The payload executed a Python script performing /proc/{PID}/mem memory scraping of Runner.Worker, Runner.Listener, runsvc, and run.sh processes to extract GitHub Actions secret JSON structures. Secrets were exfiltrated via public CI workflow logs, bypassing GitHub's log masking layer which operates at a different abstraction level. Over 23,000 repositories were affected. Both CVEs were added to CISA's Known Exploited Vulnerabilities catalog.

CASE STUDY 3 — TRIVY/AQUA SECURITY GITHUB ACTIONS (MARCH 2026):
This attack proceeded in three waves. Wave 1 (late February 2026): The attacker exploited a pull_request_target workflow vulnerability in Aqua Security's GitHub Actions, executing base branch workflows with full secret scope to extract a privileged Personal Access Token. Wave 2 (March 1-19, 2026): After public disclosure, Aqua Security performed credential rotation but critically overlooked the aqua-bot service account token, which retained release-signing permissions, providing 18 days of undetected residual access. Wave 3 (March 19, 2026, 17:43 UTC): The attacker force-pushed 76 of 77 trivy-action version tags and all 7 setup-trivy tags to malicious commit e0198fd2b6e1679e36d32933941182d9afa82f6f (unreachable from master). Simultaneously, trivy v0.69.4 was published through compromised release automation. The malicious entrypoint.sh grew from 2,855 bytes to 17,592 bytes (6.16x increase), containing a 105-line credential sweep block that executed before the legitimate scanner. On GitHub-hosted runners, it performed process memory scraping identical to the tj-actions technique. On self-hosted runners, it conducted broad filesystem sweeps targeting SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configs, Terraform state, Helm secrets, and cryptocurrency wallet files. Credentials were encrypted with AES-256-CBC and RSA-4096 session key wrapping, then exfiltrated to blockchain-based C2 infrastructure on the Internet Computer (ICP) network at tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io. A fallback exfiltration channel used GitHub releases in an attacker-created "tpcp-docs" repository.

CASE STUDY 4 — LITELLM PYPI PACKAGE (MARCH 2026):
Five days after the Trivy incident, on March 24, 2026, malicious litellm packages v1.82.7 and v1.82.8 were published directly to PyPI, bypassing the GitHub release pipeline entirely. The attack used Python .pth file auto-execution (litellm_init.pth) to run code on every Python interpreter startup. The payload created fork bomb child processes via subprocess.Popen, performed filesystem credential sweeps identical to the Trivy attack, encrypted exfiltrated data with AES-256-CBC + RSA-4096, and sent it to typosquatted domain models.litellm.cloud via HTTPS POST. In Kubernetes environments, the payload enumerated cluster secrets across all namespaces and created privileged pods in kube-system with host filesystem mounts for container escape. Persistence was established via ~/.config/systemd/user/sysmon.service.

SHARED TOOLKIT INDICATORS:
The Trivy and litellm incidents share identical persistence patterns (~/.config/sysmon.py naming), identical encryption (AES-256-CBC + RSA-4096), identical IMDS metadata harvesting, and occurred within a 5-day window, strongly suggesting a shared toolkit or unified threat actor.

BLOCKCHAIN C2 INNOVATION:
The use of Internet Computer (ICP) blockchain for C2 infrastructure represents a significant evolution. The tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io domain is censorship-resistant by design — there is no registrar, DNS operator, hosting provider, or abuse@ takedown path. Mitigation is limited to network-layer blocking via BGP null-route or perimeter domain blocking of *.icp0.io domains.

KEY INSIGHT:
As CloudSEK notes: "The most systematically targeted software in the software supply chain has been security software itself." Aqua Security's own supply chain was compromised in ways its own tooling did not detect; the compromise was discovered through behavioral anomalies detected by CrowdStrike, not security scanning.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1554 Compromise Host Software Binary
- T1546 Event Triggered Execution
- T1543 Create or Modify System Process
- T1098 Account Manipulation
- T1611 Escape to Host
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1556 Modify Authentication Process
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1585 Establish Accounts
- T1048 Exfiltration Over Alternative Protocol
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1102 Web Service

## Sources

- [CloudSEK: The Scanner Was the Weapon — 36 Months of Precision Supply Chain Attacks Against DevSecOps Infrastructure](https://www.cloudsek.com/blog/the-scanner-was-the-weapon-36-months-of-precision-supply-chain-attacks-against-devsecops-infrastructure)
- [NVD - CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094)
- [NVD - CVE-2025-30066](https://nvd.nist.gov/vuln/detail/CVE-2025-30066)
- [NVD - CVE-2025-30154](https://nvd.nist.gov/vuln/detail/CVE-2025-30154)
- [CISA Alert — XZ Utils Backdoor (CVE-2024-3094)](https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094)
- [CISA KEV — CVE-2025-30066 tj-actions/changed-files](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [GitHub Security Advisory — reviewdog/action-setup (GHSA-qmg3-hpqr-gqvc)](https://github.com/reviewdog/action-setup/security/advisories/GHSA-qmg3-hpqr-gqvc)
- [Andres Freund — XZ Utils Backdoor Discovery (oss-security)](https://www.openwall.com/lists/oss-security/2024/03/29/4)
- [StepSecurity — tj-actions Supply Chain Attack Analysis](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-attack)
- [Wiz — reviewdog/action-setup Supply Chain Compromise](https://www.wiz.io/blog/github-action-supply-chain-attack-reviewdog-action-setup)
- [Sysdig — Analysis of tj-actions/changed-files Attack](https://sysdig.com/blog/tj-actions-changed-files-supply-chain-attack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0310