Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkit
Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with (TL-2026-2516) is a critical-severity advanced persistent threat campaign scored CVSS 9.8, first published 2026-09-14. It is attributed to Red Heron (China) with medium confidence, affects Gitea Gitea, references 1 CVE (CVE-2026-60004), maps to 15 MITRE ATT&CK techniques (T1005, T1014, T1036.005), and is covered by 9 detection rules and 11 indicators of compromise.
Key facts for TL-2026-2516
- Threat ID
- TL-2026-2516
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-09-14
- Last reviewed
- 2026-09-14
- Attribution
- Red Heron
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- defense, election, energy, aerospace, telecoms, government administration, public safety, research, industrial automation, education
- Target regions
- taiwan, united states of america, canada, argentina, qatar, sri lanka
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with
Malware and tooling: AdaptixC2, JITTERLY, SIXZUT, AdaptixC2
Acronis TRU documented "Red Heron," a suspected Chinese-speaking threat actor that converted a public proof-of-concept for a critical Gitea remote code execution flaw (CVE-2026-60004, CVSS 9.8) into an automated exploitation framework within days of the July 27, 2026 patch, confirming 13 compromises across defense, election, energy, aerospace, telecom, government, public safety, and research organizations in Taiwan, the U.S., Canada, Argentina, Qatar, and Sri Lanka. Post-exploitation used a custom C++ Linux implant (JITTERLY, 30+ commands, protocol-overlapping with AdaptixC2's Gopher agent) and a previously undocumented LD_PRELOAD rootkit (SIXZUT) to steal repositories, SSH keys, and tokens, and to pivot to root-level access on Proxmox/Synology infrastructure.
How Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with works
CVE-2026-60004 is a critical (CVSS 9.8) remote code execution vulnerability in Gitea versions 1.17.0 through 1.27.0, rooted in the diffpatch API endpoint. A crafted repository patch can be used to write an executable file into Git's active hooks directory, giving an attacker with ordinary repository write access arbitrary shell execution as the Gitea OS service account. Because Gitea ships with open self-registration by default, an unauthenticated visitor can obtain the required write access simply by registering an account and creating a repository, effectively making the bug unauthenticated RCE against default configurations. Gitea patched the flaw in version 1.27.1 on July 27, 2026 (GHSA-rcr6-4jqh-j84m); a public Python PoC (HORKimhab/CVE-2026-60004) followed on July 28.
Acronis TRU attributes the subsequent campaign, tracked as "Red Heron," to a suspected Chinese-speaking actor with moderate confidence, citing Simplified Chinese-language labels used in the actor's own victim-classification datasets, a Taiwan-heavy targeting emphasis, and alignment with PRC intelligence-collection priorities. Beginning July 29, 2026 — within two days of the patch and one day after the public PoC — Red Heron adapted the PoC into an automated Python exploitation framework, exp_enhanced.py, which registered accounts on vulnerable servers, stole repository contents, and performed selective trace removal. The actor scanned 1,386 internet-exposed Gitea instances across seven countries and maintained a dedicated dataset of 477 Taiwan-based systems, ultimately confirming 13 compromises spanning defense, elections, energy, aerospace, telecommunications, government, public safety, and research targets in Taiwan, the United States, Canada, Argentina, Qatar, and Sri Lanka.
Post-exploitation activity centered on JITTERLY, a C++ Linux implant discovered on a Red Heron staging server. JITTERLY supports more than 30 post-exploitation commands covering shell execution, file transfer, process termination, network tunneling (SOCKS/TCP), reverse port forwarding, pivot relaying, and interactive PTY terminal access with resize support. JITTERLY was independently documented in July 2026 by researcher "dmpdump" after MalwareHunterTeam shared a sample ELF; that analysis found JITTERLY's networking protocol closely mirrors the open-source AdaptixC2 framework's Gopher agent — matching msgpack-serialized config fields, registration fields, and command-ID mappings — but using AES-128-GCM with 16-byte keys rather than AdaptixC2's default AES-256-GCM, indicating a modified/forked implementation rather than stock AdaptixC2 tooling.
JITTERLY is paired with SIXZUT, a previously undocumented LD_PRELOAD rootkit that masquerades as a shared object named libglthread.so.2. SIXZUT patches 15 different Linux libc functions to hide malicious files, processes, and network connections from standard enumeration tools, resists termination, and automatically relaunches JITTERLY if the implant process is killed or the rootkit is removed — providing both defense evasion and a persistence/watchdog capability.
Confirmed victim impact includes: a Canadian renewable-energy firm subjected to 22 documented exploitation sessions with theft of source-code repositories, authentication-service and CRM/HR access, API tokens, and SSH keys; a Taiwanese industrial-automation company that lost hundreds of repositories including SCADA/HMI tooling, IoT integrations, and network-utility configurations, followed by lateral movement into a Synology/Proxmox virtualization environment where a root@pam Proxmox API authentication ticket was obtained and used to deploy payloads to three cluster nodes and run vzdump backup jobs — a technique capable of exfiltrating entire VM disk images; a Qatar-based education-sector victim whose learning-management platforms and AI chatbot systems were accessed; and an Argentine quantitative-trading firm subjected to extensive internal enumeration.
Analysis of Red Heron's exposed staging server also surfaced a concurrent, separately run operation predating the Gitea weaponization: exp.py, invoked with a --shell flag against 18 websites across 10 countries, 17 of which were confirmed running Joomla. The specific Joomla vulnerability could not be confirmed because the exploit's source code was not recovered, but the --shell flag usage is consistent with backdoor deployment during post-exploitation.
CVE-2026-60004 also saw broader, unrelated opportunistic exploitation: by August 2026 an unidentified threat actor was observed dropping a cryptocurrency-miner-like payload via the same flaw (clearing LD_PRELOAD/LD_LIBRARY_PATH, killing competing high-CPU processes, then fetching and running an architecture-specific miner) — this activity is not attributed to Red Heron but corroborates the vulnerability's active, in-the-wild exploitation and its addition to the CISA Known Exploited Vulnerabilities catalog on August 25, 2026, with a federal remediation deadline of August 28, 2026.
MITRE ATT&CK techniques used in TL-2026-2516
Collection
Defense Evasion
T1014 Rootkit; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1564.001 Hide Artifacts: Hidden Files and Directories; T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Command and Control
T1071 Application Layer Protocol; T1090.001 Proxy: Internal Proxy; T1572 Protocol Tunneling; T1573.001 Encrypted Channel: Symmetric Cryptography
Privilege Escalation
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1550.001 Use Alternate Authentication Material: Application Access Token
Credential Access
T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys
Affected products and versions in Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with
- Gitea — Gitea
Vulnerable versions: 1.17.0-1.27.0
Fixed in: 1.27.1
Remediation for Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with
Patches
- Apply Gitea 1.27.1, which fixes CVE-2026-60004 / GHSA-rcr6-4jqh-j84m
Immediate actions
- Upgrade all internet-facing Gitea instances to version 1.27.1 or later immediately
- Audit Gitea repository hooks directories for unauthorized or unexpected hook scripts
- Disable open self-registration on internet-facing Gitea instances where not operationally required
- Hunt for JITTERLY and SIXZUT artifacts on Linux hosts, including any shared object masquerading as libglthread.so.2 loaded via LD_PRELOAD
- Rotate SSH keys, API tokens, and CI/CD secrets stored in or reachable from Gitea-hosted repositories
- Review Proxmox/Synology administrative authentication logs for anomalous root@pam ticket use and unexpected vzdump backup jobs
Workarounds
- If immediate patching is not possible, disable or restrict the diffpatch endpoint and repository self-registration, and place Gitea behind an authentication proxy or VPN
Longer-term hardening
- Deploy Linux EDR with LD_PRELOAD and dynamic-linker-hijacking detection and kernel-level (not solely userland) process/file/network visibility to defeat SIXZUT-class rootkits
- Segment self-hosted Git/CI infrastructure from virtualization management planes (e.g., Proxmox, Synology) so stolen repository credentials cannot be reused for lateral movement via API authentication tickets
- Establish patch-within-KEV-deadline SLAs for internet-facing developer tooling
- Monitor egress traffic for AdaptixC2/Gopher-protocol C2 patterns (msgpack framing, AES-GCM-encrypted beacon traffic)
CVEs associated with Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with
CVE-2026-60004
Weaknesses (CWE) in Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with
CWE-94
Timeline of Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with
- Researcher "dmpdump" begins analyzing the JITTERLY ELF sample after MalwareHunterTeam shares it in early July 2026, later publishing the first public documentation of the implant and its protocol overlap with AdaptixC2's Gopher agent.
- Prior to weaponizing CVE-2026-60004, Red Heron operators run exp.py with a --shell flag against 18 websites (17 confirmed Joomla) across 10 countries, later discovered via analysis of the actor's exposed staging server.
- Gitea releases version 1.27.1, fixing CVE-2026-60004 (GHSA-rcr6-4jqh-j84m).
- A public Python proof-of-concept exploit for CVE-2026-60004 (HORKimhab/CVE-2026-60004) is published on GitHub, one day after the patch.
- Red Heron begins adapting the public PoC into the exp_enhanced.py automated exploitation framework and starts scanning 1,386 internet-exposed Gitea instances across seven countries, including a dedicated 477-system Taiwan dataset.
- CISA adds CVE-2026-60004 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation.
- An unrelated, unidentified threat actor is separately observed dropping a cryptocurrency-miner-like payload via CVE-2026-60004, evidencing broader opportunistic active exploitation of the flaw (not attributed to Red Heron).
- CISA's federal civilian agency remediation deadline for CVE-2026-60004 under BOD 22-01 passes.
- Acronis Threat Research Unit (analyst Subhajeet Singha) and The Hacker News publicly disclose the Red Heron campaign, the JITTERLY implant, and the SIXZUT rootkit, confirming 13 victim organizations across six countries.
Sources cited for Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with
- Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
- Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit
- Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit
- CISA Adds One Known Exploited Vulnerability to Catalog
- CVE-2026-60004: Gitea: Remote Code Execution via diffpatch Git Hook Installation
- CISA Warns of Exploited Gitea Vulnerability
- Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)
- Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
- HORKimhab/CVE-2026-60004 (public PoC exploit repository)
- AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks
More in apt
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory
- North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain Packages
- North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle Malware
- SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign Against Central Asian Governments
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and Afghanistan Government/Defense Targets
Detection coverage for TL-2026-2516
As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2516 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.