A threat actor tracked as Red Heron has exploited the critical Gitea remote code execution vulnerability CVE-2026-60004 to steal source-code repositories, establish persistent access, and deploy a covert Linux toolset consisting of the JITTERLY implant and SIXZUT LD_PRELOAD rootkit.
Acronis reported that the actor rapidly weaponized the flaw against internet-exposed Gitea environments, turning initial access into repository theft, credential collection, lateral movement, and long-term persistence.
The campaign targeted self-hosted Gitea servers, including infrastructure belonging to an industrial automation organization. Virlabs said the attackers stole hundreds of repositories, including SCADA and HMI-related source code, and attempted to collect complete virtual-machine images.
Red Heron Exploits Critical Gitea Flaw
The operation illustrates the intelligence value of exposed developer infrastructure, where a successful compromise can provide code, credentials, deployment secrets, and paths into production environments.
At the center of the intrusion set is JITTERLY, a C++ Linux backdoor with more than 30 post-compromise capabilities. The malware supports shell execution, file operations, tunneling, interactive terminal access, process control, and internal network pivoting.
Its functionality suggests Red Heron operators can use compromised hosts for reconnaissance and as durable relay points inside victim networks.
JITTERLY is paired with SIXZUT, an LD_PRELOAD rootkit designed to conceal the malicious agents from Linux administrators and security tooling.
SIXZUT can hide files, directories, processes, and network connections, block attempts to terminate protected processes through intercepted kill() calls, and relaunch its configured payloads if they disappear.
Acronis identified the rootkit as a previously undocumented component in the Red Heron campaign. Further analysis of a SIXZUT sample uncovered an active configuration containing two hidden agents: __hesti, installed at /usr/lib/__hesti/__hesti, and __root, installed at /usr/lib/__root/__root.
The configuration linked the agents to p1.981666[.]xyz:6443 and p2.981666[.]xyz:8080, respectively. The rootkit uses those names for process and filesystem concealment while suppressing visibility of the related libnss_cache.so.2 preload library and .nss_cache.init state file.
The __hesti artifact is especially notable because HestiaCP administrators reported similar intrusion remnants months earlier following attacks involving the platform’s Web Terminal component.
Public reports identified /usr/lib/__hesti/__hesti, /lib/x86_64-linux-gnu/libnss_cache.so.2, and /etc/ld.so.preload on affected systems, while later reporting also identified /usr/lib/__root/__root.
Those overlaps strongly link the incidents at the tooling level, although they do not conclusively attribute the HestiaCP compromises to Red Heron. The expanded infrastructure picture also points to broader activity surrounding the 981666[.]xyz domain cluster.
Virlabs assessed that an actor behind attacks targeting WordPress, UniFi devices, Gitea, and ZyXEL switches was the same as or related to Red Heron, citing shared command-and-control infrastructure, malware, exploitation behavior, and tactics.
The activity reportedly included stealing more than 18,000 sensitive government records. JITTERLY uses encrypted reverse-TCP communications, MessagePack serialization, and AES-128-GCM-protected exchanges.
Defenders should treat the listed domains, IP addresses, hidden paths, preload modifications, and SIXZUT/JITTERLY hashes as high-confidence investigation leads.
Administrators should immediately patch Gitea, review /etc/ld.so.preload, inspect unusual libraries in /lib and /usr/lib, hunt for concealed __hesti and __root processes, rotate exposed credentials, and rebuild compromised hosts rather than relying solely on file deletion.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
