Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit
Red Heron exploited Gitea CVE-2026-60004 to steal repositories and deploy the JITTERLY backdoor and SIXZUT rootkit.
Acronis and Virlabs say Red Heron weaponized critical Gitea RCE CVE-2026-60004 against internet-exposed self-hosted servers, including an industrial automation organization. Attackers stole hundreds of repositories, including SCADA and HMI source code, collected credentials, moved laterally, and tried to take virtual-machine images. They deployed JITTERLY, a C++ Linux backdoor with more than 30 capabilities, and SIXZUT, an LD_PRELOAD rootkit that hides files, processes, and connections. Related 981666.xyz infrastructure has been tied to WordPress, UniFi, Gitea, and ZyXEL activity and theft of more than 18,000 government records.
- CVE-2026-60004 gave Red Heron code execution on exposed Gitea servers.
- Hundreds of repositories, including SCADA and HMI code, were stolen.
- JITTERLY is a C++ backdoor with shells, tunneling, and encrypted C2.
- SIXZUT hides __hesti and __root agents and blocks process termination.
- Shared infrastructure is linked to theft of over 18,000 government records.
- CVEs
- CVE-2026-60004
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection | 9.8 | 24% | KEVPoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 981666.xyz | b/__root/__root . The configuration linked the agents to p1.981666[.]xyz:6443 and p2.981666[.]xyz:8080 , respectively. The rootkit |
From the original article
2 min read at gbhackers.com
A threat actor tracked as Red Heron has exploited the critical Gitea remote code execution vulnerability CVE-2026-60004 to steal source-code repositories, establish persistent access, and deploy a covert Linux toolset consisting of the JITTERLY implant and SIXZUT LD_PRELOAD rootkit. Acronis reported that the actor rapidly weaponized the flaw against internet-exposed Gitea environments, turning initial access […]
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.