# Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkit

> Acronis TRU documented "Red Heron," a suspected Chinese-speaking threat actor that converted a public proof-of-concept for a critical Gitea remote code execution flaw (CVE-2026-60004, CVSS 9.8) into an automated exploitation framework within days of the July 27, 2026 patch, confirming 13 compromises across defense, election, energy, aerospace, telecom, government, public safety, and research organizations in Taiwan, the U.S., Canada, Argentina, Qatar, and Sri Lanka. Post-exploitation used a custom C++ Linux implant (JITTERLY, 30+ commands, protocol-overlapping with AdaptixC2's Gopher agent) and a previously undocumented LD_PRELOAD rootkit (SIXZUT) to steal repositories, SSH keys, and tokens, and to pivot to root-level access on Proxmox/Synology infrastructure.

- **Published:** 2026-09-14T00:00:00Z
- **Last reviewed:** 2026-11-03T16:07:06.039Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2516
- **ID:** TL-2026-2516
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Red Heron (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 43 (3 shown free below)
- **CVEs:** CVE-2026-60004

## Description

CVE-2026-60004 is a critical (CVSS 9.8) remote code execution vulnerability in Gitea versions 1.17.0 through 1.27.0, rooted in the diffpatch API endpoint. A crafted repository patch can be used to write an executable file into Git's active hooks directory, giving an attacker with ordinary repository write access arbitrary shell execution as the Gitea OS service account. Because Gitea ships with open self-registration by default, an unauthenticated visitor can obtain the required write access simply by registering an account and creating a repository, effectively making the bug unauthenticated RCE against default configurations. Gitea patched the flaw in version 1.27.1 on July 27, 2026 (GHSA-rcr6-4jqh-j84m); a public Python PoC (HORKimhab/CVE-2026-60004) followed on July 28.

Acronis TRU attributes the subsequent campaign, tracked as "Red Heron," to a suspected Chinese-speaking actor with moderate confidence, citing Simplified Chinese-language labels used in the actor's own victim-classification datasets, a Taiwan-heavy targeting emphasis, and alignment with PRC intelligence-collection priorities. Beginning July 29, 2026 — within two days of the patch and one day after the public PoC — Red Heron adapted the PoC into an automated Python exploitation framework, exp_enhanced.py, which registered accounts on vulnerable servers, stole repository contents, and performed selective trace removal. The actor scanned 1,386 internet-exposed Gitea instances across seven countries and maintained a dedicated dataset of 477 Taiwan-based systems, ultimately confirming 13 compromises spanning defense, elections, energy, aerospace, telecommunications, government, public safety, and research targets in Taiwan, the United States, Canada, Argentina, Qatar, and Sri Lanka.

Post-exploitation activity centered on JITTERLY, a C++ Linux implant discovered on a Red Heron staging server. JITTERLY supports more than 30 post-exploitation commands covering shell execution, file transfer, process termination, network tunneling (SOCKS/TCP), reverse port forwarding, pivot relaying, and interactive PTY terminal access with resize support. JITTERLY was independently documented in July 2026 by researcher "dmpdump" after MalwareHunterTeam shared a sample ELF; that analysis found JITTERLY's networking protocol closely mirrors the open-source AdaptixC2 framework's Gopher agent — matching msgpack-serialized config fields, registration fields, and command-ID mappings — but using AES-128-GCM with 16-byte keys rather than AdaptixC2's default AES-256-GCM, indicating a modified/forked implementation rather than stock AdaptixC2 tooling.

JITTERLY is paired with SIXZUT, a previously undocumented LD_PRELOAD rootkit that masquerades as a shared object named libglthread.so.2. SIXZUT patches 15 different Linux libc functions to hide malicious files, processes, and network connections from standard enumeration tools, resists termination, and automatically relaunches JITTERLY if the implant process is killed or the rootkit is removed — providing both defense evasion and a persistence/watchdog capability.

Confirmed victim impact includes: a Canadian renewable-energy firm subjected to 22 documented exploitation sessions with theft of source-code repositories, authentication-service and CRM/HR access, API tokens, and SSH keys; a Taiwanese industrial-automation company that lost hundreds of repositories including SCADA/HMI tooling, IoT integrations, and network-utility configurations, followed by lateral movement into a Synology/Proxmox virtualization environment where a root@pam Proxmox API authentication ticket was obtained and used to deploy payloads to three cluster nodes and run vzdump backup jobs — a technique capable of exfiltrating entire VM disk images; a Qatar-based education-sector victim whose learning-management platforms and AI chatbot systems were accessed; and an Argentine quantitative-trading firm subjected to extensive internal enumeration.

Analysis of Red Heron's exposed staging server also surfaced a concurrent, separately run operation predating the Gitea weaponization: exp.py, invoked with a --shell flag against 18 websites across 10 countries, 17 of which were confirmed running Joomla. The specific Joomla vulnerability could not be confirmed because the exploit's source code was not recovered, but the --shell flag usage is consistent with backdoor deployment during post-exploitation.

CVE-2026-60004 also saw broader, unrelated opportunistic exploitation: by August 2026 an unidentified threat actor was observed dropping a cryptocurrency-miner-like payload via the same flaw (clearing LD_PRELOAD/LD_LIBRARY_PATH, killing competing high-CPU processes, then fetching and running an architecture-specific miner) — this activity is not attributed to Red Heron but corroborates the vulnerability's active, in-the-wild exploitation and its addition to the CISA Known Exploited Vulnerabilities catalog on August 25, 2026, with a federal remediation deadline of August 28, 2026.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1078 Valid Accounts
- T1014 Rootkit
- T1574.006 Hijack Execution Flow: Dynamic Linker Hijacking
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1552.004 Unsecured Credentials: Private Keys
- T1552.001 Unsecured Credentials: Credentials In Files
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1572 Protocol Tunneling
- T1090.001 Proxy: Internal Proxy
- T1583.001 Acquire Infrastructure: Domains
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1136.001 Create Account: Local Account
- T1562.001 Impair Defenses: Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1110.002 Brute Force: Password Cracking
- T1057 Process Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1021.004 Remote Services: SSH
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1070 Indicator Removal
- T1049 System Network Connections Discovery
- T1571 Non-Standard Port
- T1595.002 Active Scanning
- T1543.002 Create or Modify System Process
- T1570 Lateral Tool Transfer
- T1213.003 Data from Information Repositories

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SIXZUT LD_PRELOAD Rootkit Load and JITTERLY SSH Key/Credential Theft** (`TL-2026-2516-SPL-002`)

Detects the SIXZUT LD_PRELOAD rootkit — masquerading as libglthread.so.2 and patching 15 libc functions to hide files/processes/connections and auto-relaunch JITTERLY — along with JITTERLY's collection of SSH private keys, git-credentials, and API tokens from a compromised host.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.006, T1564.001, T1036.005, T1014, T1552.004, T1552.001, T1005
- **Data sources:** linux_auditd, sysmon_for_linux, file_integrity_monitoring, osquery
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="linux:audit" (key=env_change OR syscall=execve)
| eval ld_preload_suspicious=if(match(env, "LD_PRELOAD=.*libglthread\.so\.2"), 1, 0)
| where ld_preload_suspicious=1
| append
    [ search index=linux sourcetype="linux:filesystem"
      file_name="libglthread.so.2"
      NOT file_path="/usr/lib/x86_64-linux-gnu/*"
      | eval anomalous_path=1 ]
| append
    [ search index=linux sourcetype="linux:auditd" (file_path="*/.ssh/id_*" OR file_path="*known_hosts*" OR file_path="*.git-credentials*")
      (process_name="jitterly" OR process_name="*implant*" OR parent_process="libglthread.so.2")
      | eval credential_access=1 ]
| table _time host user file_path process_name env ld_preload_suspicious anomalous_path credential_access
| sort -_time
```

### Microsoft KQL

```kql
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("LdPreloadModified", "ProcessCreated", "FileCreated")
| where (AdditionalFields has "LD_PRELOAD" and AdditionalFields has "libglthread.so.2")
    or (FileName =~ "libglthread.so.2" and FolderPath !startswith "/usr/lib/x86_64-linux-gnu")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessCommandLine, AdditionalFields
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has "/.ssh/" or FolderPath has ".git-credentials"
    | where InitiatingProcessFileName in ("jitterly", "libglthread.so.2")
    | project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessCommandLine, AdditionalFields = ""
)
| order by Timestamp desc
```

### Sigma

```yaml
title: SIXZUT LD_PRELOAD Rootkit and JITTERLY SSH Key/Credential Theft
id: b48d2f61-3e7a-4c9b-b5d6-8a1f0c3e9d22
status: experimental
description: Detects LD_PRELOAD environment injection of the libglthread.so.2 masquerading shared object (SIXZUT rootkit) and subsequent JITTERLY access to SSH private keys, git credentials, or API tokens.
references:
    - https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/
author: Threadlinqs Team
date: 2026-09-15
tags:
    - attack.defense-evasion
    - attack.t1574.006
    - attack.t1564.001
    - attack.t1036.005
    - attack.t1014
    - attack.credential-access
    - attack.t1552.004
    - attack.t1552.001
    - attack.collection
    - attack.t1005
    - attack.tool.sixzut
logsource:
    category: process_creation
    product: linux
detection:
    selection_preload:
        Environment|contains: 'LD_PRELOAD'
        Environment|contains: 'libglthread.so.2'
    selection_fake_lib:
        Image|endswith: 'libglthread.so.2'
    filter_legit_path:
        Image|startswith:
            - '/usr/lib/x86_64-linux-gnu/'
            - '/usr/lib/aarch64-linux-gnu/'
    selection_cred_access:
        CommandLine|contains:
            - '/.ssh/id_'
            - '.git-credentials'
            - 'known_hosts'
    condition: (selection_preload or (selection_fake_lib and not filter_legit_path)) or selection_cred_access
falsepositives:
    - Legitimate OpenGL/graphics libraries named libglthread on systems with GPU workloads (verify library path and hash)
level: critical
```

**Known false positives:**

- Legitimate OpenGL/graphics threading libraries coincidentally named libglthread on GPU-equipped hosts; verify library hash and load path before escalating

**Tuning notes:** Maintain an allowlist of legitimate LD_PRELOAD shared-object hashes per host image; alert only on libglthread.so.2 instances whose SHA256 does not match the vendor-signed graphics library or whose load path deviates from the standard multiarch lib directories.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Gitea diffpatch Git Hook RCE Exploitation (CVE-2026-60004) (locked: unlock with TL Creds)
- SIXZUT LD_PRELOAD Rootkit Load and JITTERLY SSH Key/Credential Theft (locked: unlock with TL Creds)
- JITTERLY AdaptixC2-Style C2 Beacon and Proxmox root@pam Ticket Reuse for Lateral Movement (locked: unlock with TL Creds)
- Gitea diffpatch Git Hook RCE Exploitation (CVE-2026-60004) (locked: unlock with TL Creds)
- SIXZUT LD_PRELOAD Rootkit Load and JITTERLY SSH Key/Credential Theft (locked: unlock with TL Creds)
- JITTERLY AdaptixC2-Style C2 Beacon and Proxmox root@pam Ticket Reuse for Lateral Movement (locked: unlock with TL Creds)
- Gitea diffpatch Git Hook RCE Exploitation (CVE-2026-60004) (locked: unlock with TL Creds)
- JITTERLY AdaptixC2-Style C2 Beacon and Proxmox root@pam Ticket Reuse for Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 43)

Defanged, TLP:CLEAR.

- IP address: `72.11.138[.]109`
- Domain: `981666[.]xyz`
- URL: `hxxps://github[.]com/HORKimhab/CVE-2026-60004`

Full set of 43 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries](https://thehackernews.com/2026/09/red-heron-exploits-gitea-rce-to.html)
- [Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit](https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/)
- [Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit](https://gbhackers.com/red-heron-hackers-exploit-critical-gitea-rce/)
- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/08/25/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CVE-2026-60004: Gitea: Remote Code Execution via diffpatch Git Hook Installation](https://advisories.gitlab.com/golang/gitea.dev/CVE-2026-60004/)
- [CISA Warns of Exploited Gitea Vulnerability](https://www.securityweek.com/cisa-warns-of-exploited-gitea-vulnerability/)
- [Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)](https://www.helpnetsecurity.com/2026/08/26/gitea-cve-2026-60004-exploited-in-the-wild/)
- [Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload](https://thehackernews.com/2026/08/critical-gitea-rce-actively-exploited.html)
- [HORKimhab/CVE-2026-60004 (public PoC exploit repository)](https://github.com/HORKimhab/CVE-2026-60004)
- [AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks](https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2516