Researchers found 35 Docker Hub images, including Debian builds, still carrying the XZ Utils backdoor a year later, ...

That operation matches the style of the XZ Utils backdoor far more than the cruder supply chain attacks of APT41 or Lazarus, by comparison. “It could very well be someone else,” says Aitel.