IT threat evolution Q2 2024

This report details multiple high-risk threats: a sophisticated supply-chain backdoor was introduced into the XZ/liblzma build to subvert OpenSSH (CVE-2024-3094) and was shipped in major Linux distributions; targeted campaigns (DuneQuixote, ToddyCat) and numerous malware families (CR4T, QakBot exploits, various stealers) are actively used for data theft and persistent access; the LockBit builder continues to enable customized ransomware operations and law enforcement disruption did not fully stop activity; and novel ransomware (ShrinkLocker) abuses BitLocker to render recovery difficult. The report highlights attacker sophistication, active exploitation evidence, and recommended mitigations.