Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit
Red Heron exploited Gitea CVE-2026-60004 to steal repositories and deploy the JITTERLY backdoor and SIXZUT rootkit.
Acronis and Virlabs say Red Heron weaponized critical Gitea RCE CVE-2026-60004 against internet-exposed self-hosted servers, including an industrial automation organization. Attackers stole hundreds of repositories, including SCADA and HMI source code, collected credentials, moved laterally, and tried to take virtual-machine images. They deployed JITTERLY, a C++ Linux backdoor with more than 30 capabilities, and SIXZUT, an LD_PRELOAD rootkit that hides files, processes, and connections. Related 981666.xyz infrastructure has been tied to WordPress, UniFi, Gitea, and ZyXEL activity and theft of more than 18,000 government records.
- CVE-2026-60004 gave Red Heron code execution on exposed Gitea servers.
- Hundreds of repositories, including SCADA and HMI code, were stolen.
- JITTERLY is a C++ backdoor with shells, tunneling, and encrypted C2.
- SIXZUT hides __hesti and __root agents and blocks process termination.
- Shared infrastructure is linked to theft of over 18,000 government records.
Vulnerabilities mentionedAll →
- CVE-2026-600049.824%Unauthenticated RCE in Gitea via diffpatch API Git Hook Injectionpublished · Gitea KEV PoC ×4
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-60004 |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | 981666.xyz | b/__root/__root . The configuration linked the agents to p1.981666[.]xyz:6443 and p2.981666[.]xyz:8080 , respectively. The rootkit |
Full article553 words · extracted from gbhackers.com · click to collapse
A threat actor tracked as Red Heron has exploited the critical Gitea remote code execution vulnerability CVE-2026-60004 to steal source-code repositories, establish persistent access, and deploy a covert Linux toolset consisting of the JITTERLY implant and SIXZUT LD_PRELOAD rootkit.
Acronis reported that the actor rapidly weaponized the flaw against internet-exposed Gitea environments, turning initial access into repository theft, credential collection, lateral movement, and long-term persistence.
The campaign targeted self-hosted Gitea servers, including infrastructure belonging to an industrial automation organization. Virlabs said the attackers stole hundreds of repositories, including SCADA and HMI-related source code, and attempted to collect complete virtual-machine images.
Red Heron Exploits Critical Gitea Flaw
The operation illustrates the intelligence value of exposed developer infrastructure, where a successful compromise can provide code, credentials, deployment secrets, and paths into production environments.
At the center of the intrusion set is JITTERLY, a C++ Linux backdoor with more than 30 post-compromise capabilities. The malware supports shell execution, file operations, tunneling, interactive terminal access, process control, and internal network pivoting.
Its functionality suggests Red Heron operators can use compromised hosts for reconnaissance and as durable relay points inside victim networks.
JITTERLY is paired with SIXZUT, an LD_PRELOAD rootkit designed to conceal the malicious agents from Linux administrators and security tooling.
SIXZUT can hide files, directories, processes, and network connections, block attempts to terminate protected processes through intercepted kill() calls, and relaunch its configured payloads if they disappear.
Acronis identified the rootkit as a previously undocumented component in the Red Heron campaign. Further analysis of a SIXZUT sample uncovered an active configuration containing two hidden agents: __hesti, installed at /usr/lib/__hesti/__hesti, and __root, installed at /usr/lib/__root/__root.
The configuration linked the agents to p1.981666[.]xyz:6443 and p2.981666[.]xyz:8080, respectively. The rootkit uses those names for process and filesystem concealment while suppressing visibility of the related libnss_cache.so.2 preload library and .nss_cache.init state file.
The __hesti artifact is especially notable because HestiaCP administrators reported similar intrusion remnants months earlier following attacks involving the platform’s Web Terminal component.
Public reports identified /usr/lib/__hesti/__hesti, /lib/x86_64-linux-gnu/libnss_cache.so.2, and /etc/ld.so.preload on affected systems, while later reporting also identified /usr/lib/__root/__root.
Those overlaps strongly link the incidents at the tooling level, although they do not conclusively attribute the HestiaCP compromises to Red Heron. The expanded infrastructure picture also points to broader activity surrounding the 981666[.]xyz domain cluster.
Virlabs assessed that an actor behind attacks targeting WordPress, UniFi devices, Gitea, and ZyXEL switches was the same as or related to Red Heron, citing shared command-and-control infrastructure, malware, exploitation behavior, and tactics.
The activity reportedly included stealing more than 18,000 sensitive government records. JITTERLY uses encrypted reverse-TCP communications, MessagePack serialization, and AES-128-GCM-protected exchanges.
Defenders should treat the listed domains, IP addresses, hidden paths, preload modifications, and SIXZUT/JITTERLY hashes as high-confidence investigation leads.
Administrators should immediately patch Gitea, review /etc/ld.so.preload, inspect unusual libraries in /lib and /usr/lib, hunt for concealed __hesti and __root processes, rotate exposed credentials, and rebuild compromised hosts rather than relying solely on file deletion.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.