Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit

Sep 13, 2026 · Original article ↗

Summary

Acronis TRU reports that Red Heron rapidly weaponized CVE-2026-60004 to exploit internet-facing Gitea servers, stealing repositories and credentials and establishing persistent access. Recovered evidence documents compromises across multiple countries, including lateral movement to root-level access on a three-node Proxmox cluster. TRU also identified JITTERLY, a Linux implant containing the previously undocumented SIXZUT rootkit. TRU assesses with moderate confidence that Red Heron operates in a PRC-linked context, but found no sufficient evidence linking it to a previously tracked group.

Key points

CVE-2026-60004 is a critical Gitea remote code execution flaw affecting versions 1.17 through 1.27.0; Gitea patched it in version 1.27.1 on July 27, 2026.
Red Heron adapted public proof-of-concept code into automated tooling that probed 1,386 Gitea instances and exploited targets where registration and the vulnerable route were accessible.
Observed activity included repository and database theft, credential collection, SSH persistence, and access to application secrets and internal infrastructure. A Taiwanese victim’s environment was escalated to root access across three Proxmox nodes.
JITTERLY is a C++ Linux implant with command execution, file transfer, tunneling, port forwarding, and pivoting capabilities. It contains SIXZUT, an LD_PRELOAD rootkit that hides files, processes, and network connections and protects or relaunches the implant.
TRU recovered malware, tooling, reconnaissance records, and stolen data from an exposed staging server. It assesses PRC-linked context with moderate confidence based on operational language, target classifications, and other evidence; direct links to a known threat group were not identified.
Acronis recommends upgrading Gitea to 1.27.1 or later, disabling unnecessary open registration, restricting internet exposure, investigating for compromise, rotating exposed credentials and secrets, and rebuilding confirmed-compromised hosts.

Attack Vectors

Exploitation of CVE-2026-60004 through Gitea’s diffpatch endpoint; open registration could allow account creation without pre-existing credentials.
Post-compromise use of stolen credentials, SSH keys, and backdoors for persistence and movement into connected infrastructure.

Defensive Notes

Upgrade Gitea to version 1.27.1 or later; disable open registration when unnecessary and restrict the diffpatch route and internet exposure.
Review newly created accounts and repositories, diffpatch and metrics API requests, Gitea-spawned processes, /etc/ld.so.preload, SSH authorized_keys, and unfamiliar outbound connections.
Hunt for SIXZUT artifacts using trusted offline, kernel-level, or EDR telemetry because the rootkit can hide them from live userland tools.
Rotate credentials, tokens, and SSH host keys stored in compromised Gitea instances. Rebuild confirmed-compromised hosts rather than relying on cleanup.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`2[.]981666[.]xyz`	Listed as a JITTERLY C2 domain.
DOMAIN	`981666[.]xyz`	Listed as the parent domain of the JITTERLY C2 domain.
DOMAIN	`s2[.]981666[.]xyz`	JITTERLY’s embedded C2 address; the article gives it with port 8082.
DOMAIN	`xcyoibfhuufz[.]com`	Listed as a related domain.
IPV4	`72[.]11[.]138[.]109`	Listed as the exposed staging server.
SHA256	`28b132ad55bd310bb5cf3ddb4ace580529ad735204a48cf388830d9039843d8e`	SHA-256 hash listed for the SIXZUT rootkit decrypted from JITTERLY.
SHA256	`b441f793c87e54cb7e3f7205e25442aa19920d325cb6af41d2afdc8a0b5cf54f`	SHA-256 hash listed for the JITTERLY implant.