Skip to navigation

Threat reportAPTTL-2026-2516

Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkit

criticalACTIVE

Acronis TRU documented "Red Heron," a suspected Chinese-speaking threat actor that converted a public proof-of-concept for a critical Gitea remote code execution flaw (CVE-2026-60004, CVSS 9.8) into an automated exploitation framework within days of the July 27, 2026 patch, confirming 13 compromises across defense, election, energy, aerospace, telecom, government, public safety, and research organizations in Taiwan, the U.S., Canada, Argentina, Qatar, and Sri Lanka.

Key facts

IdentifiersTL-2026-2516, CVE-2026-60004
SeverityCRITICAL
CVSS9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Exploitation statusLinked CVE exploited in the wild; Listed in CISA KEV: CVE-2026-60004 (added )
EPSSCVE-2026-60004: 23.9% (97.7th percentile)
Affected productsGitea Gitea
Weaknesses (CWE)CWE-94
AttributionRed Heron (medium confidence)
Nation-state nexusChina
MalwareAdaptixC2, JITTERLY, SIXZUT
ToolsAdaptixC2
MITRE ATT&CK techniquesT1005 Data from Local System, T1014 Rootkit, T1021.004 Remote Services: SSH, T1027 Obfuscated Files or Information, T1036.005 Masquerading: Match Legitimate Resource Name or Location, T1041 Exfiltration Over C2 Channel, T1049 System Network Connections Discovery, T1057 Process Discovery, T1059.004 Command and Scripting Interpreter: Unix Shell, T1070 Indicator Removal, T1071 Application Layer Protocol, T1078 Valid Accounts and 24 more in the attack flow
MotivationESPIONAGE
Target sectorsdefense, election, energy, aerospace, telecoms, government administration, public safety, research, industrial automation, education
Target regionstaiwan, united states of america, canada, argentina, qatar, sri lanka
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2516 across Splunk SPL, Microsoft KQL and Sigma, covering 43 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SIXZUT LD_PRELOAD Rootkit Load and JITTERLY SSH Key/Credential Theft

Detects the SIXZUT LD_PRELOAD rootkit — masquerading as libglthread.so.2 and patching 15 libc functions to hide files/processes/connections and auto-relaunch JITTERLY — along with JITTERLY's collection of SSH private keys, git-credentials, and API tokens from a compromised host.

Splunk SPL

index=linux sourcetype="linux:audit" (key=env_change OR syscall=execve)
| eval ld_preload_suspicious=if(match(env, "LD_PRELOAD=.*libglthread\.so\.2"), 1, 0)
| where ld_preload_suspicious=1
| append
    [ search index=linux sourcetype="linux:filesystem"
      file_name="libglthread.so.2"
      NOT file_path="/usr/lib/x86_64-linux-gnu/*"
      | eval anomalous_path=1 ]
| append
    [ search index=linux sourcetype="linux:auditd" (file_path="*/.ssh/id_*" OR file_path="*known_hosts*" OR file_path="*.git-credentials*")
      (process_name="jitterly" OR process_name="*implant*" OR parent_process="libglthread.so.2")
      | eval credential_access=1 ]
| table _time host user file_path process_name env ld_preload_suspicious anomalous_path credential_access
| sort -_time

Microsoft KQL

DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("LdPreloadModified", "ProcessCreated", "FileCreated")
| where (AdditionalFields has "LD_PRELOAD" and AdditionalFields has "libglthread.so.2")
    or (FileName =~ "libglthread.so.2" and FolderPath !startswith "/usr/lib/x86_64-linux-gnu")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessCommandLine, AdditionalFields
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has "/.ssh/" or FolderPath has ".git-credentials"
    | where InitiatingProcessFileName in ("jitterly", "libglthread.so.2")
    | project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessCommandLine, AdditionalFields = ""
)
| order by Timestamp desc

Sigma

title: SIXZUT LD_PRELOAD Rootkit and JITTERLY SSH Key/Credential Theft
id: b48d2f61-3e7a-4c9b-b5d6-8a1f0c3e9d22
status: experimental
description: Detects LD_PRELOAD environment injection of the libglthread.so.2 masquerading shared object (SIXZUT rootkit) and subsequent JITTERLY access to SSH private keys, git credentials, or API tokens.
references:
    - https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/
author: Threadlinqs Team
date: 2026-09-15
tags:
    - attack.defense-evasion
    - attack.t1574.006
    - attack.t1564.001
    - attack.t1036.005
    - attack.t1014
    - attack.credential-access
    - attack.t1552.004
    - attack.t1552.001
    - attack.collection
    - attack.t1005
    - attack.tool.sixzut
logsource:
    category: process_creation
    product: linux
detection:
    selection_preload:
        Environment|contains: 'LD_PRELOAD'
        Environment|contains: 'libglthread.so.2'
    selection_fake_lib:
        Image|endswith: 'libglthread.so.2'
    filter_legit_path:
        Image|startswith:
            - '/usr/lib/x86_64-linux-gnu/'
            - '/usr/lib/aarch64-linux-gnu/'
    selection_cred_access:
        CommandLine|contains:
            - '/.ssh/id_'
            - '.git-credentials'
            - 'known_hosts'
    condition: (selection_preload or (selection_fake_lib and not filter_legit_path)) or selection_cred_access
falsepositives:
    - Legitimate OpenGL/graphics libraries named libglthread on systems with GPU workloads (verify library path and hash)
level: critical

Known false positives:

  • Legitimate OpenGL/graphics threading libraries coincidentally named libglthread on GPU-equipped hosts; verify library hash and load path before escalating

Tuning notes: Maintain an allowlist of legitimate LD_PRELOAD shared-object hashes per host image; alert only on libglthread.so.2 instances whose SHA256 does not match the vendor-signed graphics library or whose load path deviates from the standard multiarch lib directories.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Gitea diffpatch Git Hook RCE Exploitation (CVE-2026-60004) · unlock with TL Creds
  • SIXZUT LD_PRELOAD Rootkit Load and JITTERLY SSH Key/Credential Theft · unlock with TL Creds
  • JITTERLY AdaptixC2-Style C2 Beacon and Proxmox root@pam Ticket Reuse for Lateral Movement · unlock with TL Creds
  • Gitea diffpatch Git Hook RCE Exploitation (CVE-2026-60004) · unlock with TL Creds
  • SIXZUT LD_PRELOAD Rootkit Load and JITTERLY SSH Key/Credential Theft · unlock with TL Creds
  • JITTERLY AdaptixC2-Style C2 Beacon and Proxmox root@pam Ticket Reuse for Lateral Movement · unlock with TL Creds
  • Gitea diffpatch Git Hook RCE Exploitation (CVE-2026-60004) · unlock with TL Creds
  • JITTERLY AdaptixC2-Style C2 Beacon and Proxmox root@pam Ticket Reuse for Lateral Movement · unlock with TL Creds

Indicators of compromise

As of 2026-11-03, Threadlinqs Intelligence tracks 43 indicators of compromise for TL-2026-2516.

Sample indicators (3 of 43)

  • IP address: 72.11.138[.]109
  • Domain: 981666[.]xyz
  • URL: hxxps://github[.]com/HORKimhab/CVE-2026-60004

Defanged, TLP:CLEAR. Full set of 43 indicators: unlock with TL Creds.

43 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Post-exploitation used a custom C++ Linux implant (JITTERLY, 30+ commands, protocol-overlapping with AdaptixC2's Gopher agent) and a previously undocumented LD_PRELOAD rootkit (SIXZUT) to steal repositories, SSH keys, and tokens, and to pivot to root-level access on Proxmox/Synology infrastructure.

CVE-2026-60004 is a critical (CVSS 9.8) remote code execution vulnerability in Gitea versions 1.17.0 through 1.27.0, rooted in the diffpatch API endpoint. A crafted repository patch can be used to write an executable file into Git's active hooks directory, giving an attacker with ordinary repository write access arbitrary shell execution as the Gitea OS service account. Because Gitea ships with open self-registration by default, an unauthenticated visitor can obtain the required write access simply by registering an account and creating a repository, effectively making the bug unauthenticated RCE against default configurations. Gitea patched the flaw in version 1.27.1 on July 27, 2026 (GHSA-rcr6-4jqh-j84m); a public Python PoC (HORKimhab/CVE-2026-60004) followed on July 28.

Acronis TRU attributes the subsequent campaign, tracked as "Red Heron," to a suspected Chinese-speaking actor with moderate confidence, citing Simplified Chinese-language labels used in the actor's own victim-classification datasets, a Taiwan-heavy targeting emphasis, and alignment with PRC intelligence-collection priorities. Beginning July 29, 2026 — within two days of the patch and one day after the public PoC — Red Heron adapted the PoC into an automated Python exploitation framework, exp_enhanced.py, which registered accounts on vulnerable servers, stole repository contents, and performed selective trace removal. The actor scanned 1,386 internet-exposed Gitea instances across seven countries and maintained a dedicated dataset of 477 Taiwan-based systems, ultimately confirming 13 compromises spanning defense, elections, energy, aerospace, telecommunications, government, public safety, and research targets in Taiwan, the United States, Canada, Argentina, Qatar, and Sri Lanka.

Post-exploitation activity centered on JITTERLY, a C++ Linux implant discovered on a Red Heron staging server. JITTERLY supports more than 30 post-exploitation commands covering shell execution, file transfer, process termination, network tunneling (SOCKS/TCP), reverse port forwarding, pivot relaying, and interactive PTY terminal access with resize support. JITTERLY was independently documented in July 2026 by researcher "dmpdump" after MalwareHunterTeam shared a sample ELF; that analysis found JITTERLY's networking protocol closely mirrors the open-source AdaptixC2 framework's Gopher agent — matching msgpack-serialized config fields, registration fields, and command-ID mappings — but using AES-128-GCM with 16-byte keys rather than AdaptixC2's default AES-256-GCM, indicating a modified/forked implementation rather than stock AdaptixC2 tooling.

JITTERLY is paired with SIXZUT, a previously undocumented LD_PRELOAD rootkit that masquerades as a shared object named libglthread.so.2. SIXZUT patches 15 different Linux libc functions to hide malicious files, processes, and network connections from standard enumeration tools, resists termination, and automatically relaunches JITTERLY if the implant process is killed or the rootkit is removed — providing both defense evasion and a persistence/watchdog capability.

Confirmed victim impact includes: a Canadian renewable-energy firm subjected to 22 documented exploitation sessions with theft of source-code repositories, authentication-service and CRM/HR access, API tokens, and SSH keys; a Taiwanese industrial-automation company that lost hundreds of repositories including SCADA/HMI tooling, IoT integrations, and network-utility configurations, followed by lateral movement into a Synology/Proxmox virtualization environment where a root@pam Proxmox API authentication ticket was obtained and used to deploy payloads to three cluster nodes and run vzdump backup jobs — a technique capable of exfiltrating entire VM disk images; a Qatar-based education-sector victim whose learning-management platforms and AI chatbot systems were accessed; and an Argentine quantitative-trading firm subjected to extensive internal enumeration.

Analysis of Red Heron's exposed staging server also surfaced a concurrent, separately run operation predating the Gitea weaponization: exp.py, invoked with a --shell flag against 18 websites across 10 countries, 17 of which were confirmed running Joomla. The specific Joomla vulnerability could not be confirmed because the exploit's source code was not recovered, but the --shell flag usage is consistent with backdoor deployment during post-exploitation.

CVE-2026-60004 also saw broader, unrelated opportunistic exploitation: by August 2026 an unidentified threat actor was observed dropping a cryptocurrency-miner-like payload via the same flaw (clearing LD_PRELOAD/LD_LIBRARY_PATH, killing competing high-CPU processes, then fetching and running an architecture-specific miner) — this activity is not attributed to Red Heron but corroborates the vulnerability's active, in-the-wild exploitation and its addition to the CISA Known Exploited Vulnerabilities catalog on August 25, 2026, with a federal remediation deadline of August 28, 2026.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213.003 Data from Information Repositories

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1070 Indicator Removal; T1562.001 Impair Defenses: Disable or Modify Tools; T1564.001 Hide Artifacts: Hidden Files and Directories; T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking

Lateral Movement

T1021.004 Remote Services: SSH; T1550.001 Use Alternate Authentication Material: Application Access Token; T1570 Lateral Tool Transfer

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell

Command and Control

T1071 Application Layer Protocol; T1090.001 Proxy: Internal Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573.001 Encrypted Channel: Symmetric Cryptography

Privilege Escalation

T1078 Valid Accounts

Persistence

T1098.004 Account Manipulation: SSH Authorized Keys; T1136.001 Create Account: Local Account; T1543.002 Create or Modify System Process

Credential Access

T1110.002 Brute Force: Password Cracking; T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys

Initial Access

T1190 Exploit Public-Facing Application

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1595.002 Active Scanning

Remediation

Patches

  • Apply Gitea 1.27.1, which fixes CVE-2026-60004 / GHSA-rcr6-4jqh-j84m

Immediate actions

  • Upgrade all internet-facing Gitea instances to version 1.27.1 or later immediately
  • Audit Gitea repository hooks directories for unauthorized or unexpected hook scripts
  • Disable open self-registration on internet-facing Gitea instances where not operationally required
  • Hunt for JITTERLY and SIXZUT artifacts on Linux hosts, including any shared object masquerading as libglthread.so.2 loaded via LD_PRELOAD
  • Rotate SSH keys, API tokens, and CI/CD secrets stored in or reachable from Gitea-hosted repositories
  • Review Proxmox/Synology administrative authentication logs for anomalous root@pam ticket use and unexpected vzdump backup jobs

Workarounds

  • If immediate patching is not possible, disable or restrict the diffpatch endpoint and repository self-registration, and place Gitea behind an authentication proxy or VPN

Longer-term hardening

  • Deploy Linux EDR with LD_PRELOAD and dynamic-linker-hijacking detection and kernel-level (not solely userland) process/file/network visibility to defeat SIXZUT-class rootkits
  • Segment self-hosted Git/CI infrastructure from virtualization management planes (e.g., Proxmox, Synology) so stolen repository credentials cannot be reused for lateral movement via API authentication tickets
  • Establish patch-within-KEV-deadline SLAs for internet-facing developer tooling
  • Monitor egress traffic for AdaptixC2/Gopher-protocol C2 patterns (msgpack framing, AES-GCM-encrypted beacon traffic)

Affected and fixed versions

  • Gitea — Gitea
    Vulnerable versions: 1.17.0-1.27.0
    Fixed in: 1.27.1

Timeline

Last updated · 3 updates · revalidated 3× · latest source

  • Researcher "dmpdump" begins analyzing the JITTERLY ELF sample after MalwareHunterTeam shares it in early July 2026, later publishing the first public documentation of the implant and its protocol overlap with AdaptixC2's Gopher agent.
  • Prior to weaponizing CVE-2026-60004, Red Heron operators run locked-ioc-20 with a --shell flag against 18 websites (17 confirmed Joomla) across 10 countries, later discovered via analysis of the actor's exposed staging server.
  • Gitea maintainers merge and backport the fix for the diffpatch add/add-collision RCE (CVE-2026-60004), one day ahead of the 1.27.1 release.
  • Gitea releases version 1.27.1, fixing CVE-2026-60004 (GHSA-rcr6-4jqh-j84m).
  • A public Python proof-of-concept exploit for CVE-2026-60004 (HORKimhab/CVE-2026-60004) is published on GitHub, one day after the patch.
  • Red Heron begins adapting the public PoC into the locked-ioc-14 automated exploitation framework and starts scanning 1,386 internet-exposed Gitea instances across seven countries, including a dedicated 477-system Taiwan dataset.
  • Operator completes a FOFA-driven scan of 1,386 internet-exposed Gitea instances across seven countries.
  • Operator compiles a dedicated Taiwan-focused target list of 477 Gitea instances.
  • Operator develops the fully automated locked-ioc-14 framework capable of account registration, exploitation, exfiltration, and trace removal.
  • Operator runs a batch exploitation pass against 50 Taiwanese Gitea targets with mixed exfiltration results.
  • Acronis TRU discovers the operator's staging server (locked-ioc-18:8888) during infrastructure tracking.
  • CISA adds CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation.
  • An unrelated, unidentified threat actor is separately observed dropping a cryptocurrency-miner-like payload via CVE-2026-60004, evidencing broader opportunistic active exploitation of the flaw (not attributed to Red Heron).
  • CISA's federal civilian agency remediation deadline for CVE-2026-60004 under BOD 22-01 passes.
  • Acronis Threat Research Unit (analyst Subhajeet Singha) and The Hacker News publicly disclose the Red Heron campaign, the JITTERLY implant, and the SIXZUT rootkit, confirming 13 victim organizations across six countries.
  • Cloud Security Alliance publishes a research note summarizing the Red Heron Gitea campaign (11-13 compromised organizations).

Update history

Sources cited

Other reports on CVE-2026-60004

Previous and next in apt

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats