Author: DigitalSpying Security Desk
Date: September 14, 2026
Executive Summary
In a sophisticated cross-border cyber espionage campaign targeting critical infrastructure, defense contractors, and technology firms, security researchers at Acronis Threat Research Unit (TRU) have exposed an advanced threat group tracked as Red Heron. The threat actor—assessed with moderate confidence to be aligned with Chinese state intelligence priorities—rapidly operationalized a critical Remote Code Execution vulnerability in self-hosted Gitea code collaboration servers (CVE-2026-60004).
Telemetry revealed that Red Heron conducted automated reconnaissance against 1,386 Gitea instances across seven nations, maintaining an active target dataset of 477 organizations in Taiwan alone. The campaign resulted in confirmed, deep intrusions across 13 high-profile entities spanning the United States, Canada, Taiwan, Argentina, Qatar, and Sri Lanka. Intrusions advanced from automated source code and credential theft to full root-level compromise of core enterprise virtualization clusters (such as three-node Proxmox deployments), supported by a custom C++ Linux implant named JITTERLY and a stealthy, previously undocumented LD_PRELOAD rootkit dubbed SIXZUT.
Deep-Dive Technical Analysis
1. Automated Exploitation Framework (exp_enhanced.py)
Within days of the initial public proof-of-concept release for CVE-2026-60004 (a critical remote code execution vulnerability in self-hosted Gitea Git service instances), Red Heron engineered a customized, automated Python attack tool designated exp_enhanced.py:
* Mass Reconnaissance & Account Creation: The framework automates the registration of rogue accounts on public-facing Gitea servers where user sign-up is permitted.
* Payload Delivery & Repository Extraction: Once an authenticated session is established, exp_enhanced.py triggers the RCE flaw to achieve shell execution on the underlying hosting host. It immediately clones and archives all accessible private repositories, configuration files, and environment secrets (.env, database connection strings, SSH private keys).
* Automated Anti-Forensic Cleaning: The script issues API calls and shell commands to purge the newly created user accounts and remove selected entries from Gitea access logs to hinder immediate detection.
2. The JITTERLY Linux Implant
On compromised hosts where high intelligence value was identified, Red Heron deployed JITTERLY, a powerful C++ modular Linux backdoor sharing code overlaps with the AdaptixC2 framework:
* Comprehensive Command Suite: JITTERLY supports more than 30 distinct post-exploitation subroutines, including interactive reverse terminal access, multi-hop SOCKS5 network tunneling, dynamic process injection, file upload/download, and remote process killing.
* Target Profiling & Host Reconnaissance: Upon execution, JITTERLY fingerprints the underlying host, harvesting CPU architectures, kernel versions, active network interfaces, ARP tables, and mounted storage partitions.
3. The SIXZUT Stealth LD_PRELOAD Rootkit
To guarantee persistence and conceal operations from endpoint detection and incident responders, Red Heron packaged JITTERLY alongside an undocumented userland rootkit named SIXZUT:
* Library Hooking via LD_PRELOAD: SIXZUT injects itself into user-space processes by populating /etc/ld.so.preload or hijacking dynamic linking dependencies.
* Hooking 15 Critical System Calls: The rootkit hooks 15 core Linux API functions (including readdir, readdir64, open, open64, stat, lstat, and unlink).
* Tri-Layer Concealment:
1. File Hiding: Suppresses any files or directories matching hardcoded prefixes or SHA-256 hashes from directory listing utilities (ls, find).
2. Process Cloaking: Masks JITTERLY process IDs (PIDs) from process enumeration tools (ps, top, htop).
3. Socket Concealment: Sanitizes /proc/net/tcp and /proc/net/tcp6 outputs, masking established outbound command-and-control (C2) network sockets from netstat and ss.
* Self-Healing & Auto-Respawn: If JITTERLY is terminated or its binary is removed from disk, SIXZUT's hooked execution hooks detect the absence and automatically respawn the implant from hidden memory copies.
+----------------------------------------------------------------------------------------------------+
| RED HERON GITEA INTRUSION KILL CHAIN |
|---|
[Red Heron Automated Reconnaissance Engine]
|
| 1. Dispatches exp_enhanced.py against 1,386 Internet-Facing Gitea Servers
v
[Target Gitea Code Collaboration Server]
|
|-- Exploits CVE-2026-60004 (Gitea Critical RCE)
|-- Automated Source Code, Secrets, & Private Repository Exfiltration
v
[Deployment of JITTERLY & SIXZUT Toolset]
|
| 2. Drops JITTERLY C++ Backdoor (30+ Post-Exploitation Commands)
| 3. Deploys SIXZUT LD_PRELOAD Rootkit:
| * Hooks 15 System Calls (Hides Files, Processes, & Sockets)
| * Auto-Respawns JITTERLY if Terminated
v
[Lateral Movement & Infrastructure Escalation]
|
| 4. Discovers Virtualization Infrastructure & Hypervisor Credentials
v
[Full Root Administrative Compromise of Enterprise 3-Node Proxmox Cluster]
|
+---> Exfiltration of SCADA/HMI Source Code & IoT Platform Designs
+---> Exfiltration of Renewable Energy Infrastructure & Defense Assets
4. Lateral Pivoting to Virtualization Infrastructure
A hallmark of Red Heron's tradecraft is rapidly translating application-layer breaches into hypervisor-level control. In a confirmed compromise of a major Taiwanese enterprise, Red Heron extracted SSH keys and administrative credentials from repository files, pivoting laterally from the containerized Gitea host to achieve unrestricted root administrative access across a three-node Proxmox virtualization cluster.
Target Sector
Primary Region
Intelligence Exfiltrated
Industrial Automation
Taiwan
SCADA/HMI tooling, industrial IoT middleware, internal network packet sniffers, proprietary surveillance software.
Renewable Energy
Canada
Infrastructure topology maps, SSH host keys, API integration tokens, control source code.
Government & Research
US, Qatar, Argentina, Sri Lanka
Election infrastructure data, defense logistics applications, internal AI workflow platforms.
Industry Impact & Supply Chain Risks
* DevOps as the Critical Attack Surface: Self-hosted code repositories (Gitea, GitLab, GitHub Enterprise) are the crown jewels of enterprise engineering. Gaining repository access grants attackers the keys to all downstream software builds, API secrets, and cloud deployment pipelines.
* N-Day Vulnerability Velocity: The speed at which Red Heron converted a publicly disclosed CVE into a weaponized mass-scanning pipeline demonstrates that organizations have mere days—not weeks—to patch self-hosted developer tools before automated APT scanning takes hold.
Actionable Recommendations & Hardening Playbook
1. Upgrade Gitea Instances Immediately
* Verify that all self-hosted Gitea deployments are updated to patched releases addressing CVE-2026-60004.
* Disable public user registration (ENABLE_OPENID_SIGNIN = false and DISABLE_REGISTRATION = true in app.ini) unless strictly necessary.
2. Audit Systems for SIXZUT Rootkit Artifacts
Because SIXZUT intercepts standard Linux commands, standard forensic tools running on the infected OS will return falsified results:
* Check Preload Files: Inspect /etc/ld.so.preload and /etc/ld.so.conf.d/ directly or boot from an independent live forensic USB/ISO environment to inspect filesystem blocks.
* Look for Hooking Discrepancies: Use kernel-level audit tools or static eBPF-based monitoring (such as Tetragon or Falco) that query kernel tracepoints directly, bypassing user-space dynamic linking hooks.
3. Hypervisor & Infrastructure Isolation
* Segment Virtualization Management: Isolate Proxmox, VMware ESXi, and hypervisor management interfaces onto dedicated, non-routable management VLANs accessible only via multi-factor authenticated jump hosts.
* Sanitize Source Repositories: Enforce automated secret scanning (such as Trufflehog or Gitleaks) within CI/CD pipelines to prevent developers from committing hardcoded SSH private keys, cloud access tokens, or hypervisor credentials into Git history.
Sources and Reference Intelligence
* The Hacker News
* Acronis Threat Research Unit (TRU)
* NIST National Vulnerability Database