Red Heron Exploits Critical Gitea RCE Flaw to Deploy Linux Backdoor and Rootkit A suspected Chinese-speaking threat actor, Red Heron, has been exploiting CVE-2026-60004, a critical remote code execution (RCE) vulnerability in Gitea (versions 1.17–1.27.0), to target internet-exposed source-code servers. The campaign, uncovered by Acronis Threat Research Unit, focuses on stealing proprietary repositories and deploying two malicious tools: the JITTERLY Linux backdoor and the SIXZUT rootkit. The attack leverages Gitea’s vulnerable diffpatch API to gain remote execution, enabling threat actors to exfiltrate sensitive data including SCADA- and HMI-related source code from an industrial automation victim. The post-exploitation chain centers on JITTERLY, a C++ Linux implant with over 30 capabilities, such as remote shell execution, file transfers, SOCKS tunneling, and internal network pivoting. To evade detection, Red Heron deploys SIXZUT, an LD_PRELOAD rootkit that conceals malicious files, processes, and network connections by intercepting Linux library functions. The rootkit also resists termination, automatically relaunching agents if stopped, and relies on /etc/ld.so.preload for persistence making cleanup risky without a full system rebuild. Analysis of SIXZUT samples revealed an encrypted configuration linking to two JITTERLY agents: - __hesti (p1.981666[.]xyz:6443) - __root (p2.981666[.]xyz:8080) These agents overlap with artifacts reported in 2026 HestiaCP intrusions, where administrators found unauthorized access and malicious files like /usr/lib/__hesti/__hesti and /lib/x86_64-linux-gnu/libnss_cache.so.2. The 981666[.]xyz infrastructure has also been tied to other Linux malware, including implants targeting UniFi devices, suggesting broader activity by the same or related actors. Virlabs linked Red Heron to the theft of over 18,000 government records and exploitation across multiple device and software ecosystems, reinforcing the group’s sophisticated and persistent threat profile.