Nation-state hackers infiltrate open-source software

Nation-state hackers infiltrate open-source software State-sponsored hackers from Russia, China and North Korea are systematically infiltrating the open-source software that powers over 90% of modern applications, according to a report released today by Strider Technologies. The intelligence firm's analysis reveals how adversarial nation-states are weaponizing platforms like GitHub to embed malicious code into widely-used software repositories, creating cascading security risks across industries and governments worldwide. Strider's research identified contributors with direct affiliations to sanctioned Russian and Chinese entities actively contributing to critical open-source projects. More than 21% of contributors to openvino-genai—an AI inference toolkit downloaded over one million times—were flagged as presenting nation-state security threats. Two contributors were linked to MFI Soft and Positive Technologies, Russian companies sanctioned by the U.S. for supporting intelligence collection and cyberattacks. Sophisticated Long-Term Infiltration The report documents how advanced persistent threat groups like APT41 from China, Russia's Cozy Bear, and North Korea's Lazarus Group are employing patient, years-long strategies to gain credibility within open-source communities . "Actors will spend years building respectable reputations before adding their own harmful code," explained Paige Waltz, Strider's Director of Global Communications . Some attackers contribute 40 to 50 times to a codebase before injecting malicious backdoors, making detection extremely difficult . North Korea's Lazarus Group has intensified these efforts, with Sonatype detecting 234 unique malicious packages tied to the group in the first half of 2025 alone, potentially compromising 36,000 developers globally . The group's Operation Marstech Mayhem campaign demonstrates this evolution, using fake GitHub repositories to distribute the sophisticated "Marstech1" implant targeting cryptocurrency wallets and credentials . Billion-Dollar Impact from Past Attacks The vulnerability of open-source software has already proven costly. The 2021 Log4Shell vulnerability exploitation, involving actors from China, North Korea, Iran and Turkey, cost affected organizations upwards of $90,000 per incident response . Nearly two years after the incident, 72% of affected organizations were still reporting active exploitation events . Recent incidents like the XZ Utils backdoor attempt in February 2024 highlight the sophisticated nature of these threats . The attacker, using the pseudonym "Jia Tan," spent years building trust within the Linux community before attempting to plant a backdoor in compression software used across numerous systems worldwide . "Nation-states like China and Russia are exploiting this visibility gap," said Greg Levesque, CEO of Strider Technologies . "Individuals are lying in wait, building credibility in the ecosystem with the power to introduce malicious code with devastating downstream effects."

Nation-state hackers infiltrate open-source software

Topics included

Social.
Snapshot.

Explore similar content

Nation-state hackers infiltrate open-source software

Topics included

Social.Snapshot.

Explore similar content

Social.
Snapshot.