Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – Red Heron exploited internet-facing Gitea instances through CVE-2026-60004 to gain code execution and access (‘rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea’).
• [T1588.001 ] Malware – The actor used public proof-of-concept code and built custom tooling from it to weaponize the vulnerability (‘cloned a PoC from GitHub … and started building on top of it’).
• [T1059 ] Command and Scripting Interpreter – The operator used shell commands and scripts during exploitation, testing, and post-compromise activity (‘running multiple RCE sessions’, ‘echo … | nc’).
• [T1105 ] Ingress Tool Transfer – The actor downloaded PoC code and planted payloads/backdoors on victims and Proxmox nodes (‘pulled HORKimhab’s public proof-of-concept’, ‘uploaded payloads to three separate Proxmox nodes’).
• [T1068 ] Exploitation for Privilege Escalation – The campaign escalated from Gitea access to root-level access on a Proxmox cluster (‘obtained a Proxmox root authentication ticket … giving them full administrative access’).
• [T1110 ] Brute Force – The actor used hashcat to crack stolen Gitea database credentials (‘Hashcat was installed on the staging server for cracking stolen Gitea database credentials’).
• [T1021.004 ] Remote Services: SSH – The actor used SSH for persistence and remote access (‘SSH backdoor keys were planted’, ‘connected over SSH to a compromised Taiwanese NAS’).
• [T1078 ] Valid Accounts – Red Heron registered throwaway accounts and used compromised credentials for access (‘auto-register accounts’, ‘credential collection’).
• [T1005 ] Data from Local System – The tooling dumped repositories and database contents directly from the filesystem (‘dump repositories directly from the filesystem’, ‘the –dump-fs flag’).
• [T1041 ] Exfiltration Over C2 Channel – Recovered data was mirrored off the staging server and pulled from victims (‘exec.sh script that mirrors stolen data off the staging server’).
• [T1027 ] Obfuscated Files or Information – JITTERLY and SIXZUT used XOR and AES to hide strings, configs, and payloads (‘decrypts an embedded rootkit’, ‘XOR with key 0x3C’).
• [T1543.002 ] Create or Modify System Process: Systemd Service – The backdoor disguised itself as service-like components (‘systemd-network-helper.service’, ‘systemd-resolved-helper.service’).
• [T1547.006 ] Boot or Logon Autostart Execution: Kernel Modules and Extensions – SIXZUT persisted by writing to LD_PRELOAD so processes load it automatically (‘written into the system’s LD_PRELOAD configuration’).
• [T1014 ] Rootkit – SIXZUT hid files, processes, network connections, and resisted termination (‘hide files, processes, and network connections’, ‘protect JITTERLY from termination’).
• [T1095 ] Non-Application Layer Protocol – JITTERLY used raw TCP with a custom framing protocol (‘C2 traffic runs over raw TCP sockets with a custom framing protocol’).
• [T1106 ] Native API – The implant used low-level Linux APIs such as readlink, getsockname, setsid, and dup2 for stealth and host profiling (‘calls setsid()’, ‘uses getsockname()’).
• [T1021.001 ] Remote Services: Remote Desktop/GUI? – Not clearly supported; omitted.