The long road to root. [Research Saturday]

Today we are joined by ⁠Subhajeet Singha⁠, Senior Security Researcher at ⁠Acronis⁠ Threat Research Unit, discussing their work on "Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit." A Chinese-speaking threat actor tracked as Red Heron exploited a critical Gitea remote code execution vulnerability, CVE-2026-60004, within days of its public disclosure, compromising organizations across five countries and stealing source code, credentials, and sensitive infrastructure data.

The campaign involved deploying persistent backdoors and a newly identified Linux implant called JITTERLY, which contains an undocumented rootkit, SIXZUT, capable of hiding files, processes, and network connections while protecting the malware from removal. Acronis assesses with moderate confidence that Red Heron operates within a PRC-linked context, highlighting how quickly attackers can weaponize newly disclosed vulnerabilities and turn exposed development platforms into gateways for broader network compromise.

The research and executive brief can be found here:

• ⁠⁠⁠⁠Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit⁠

Learn more about your ad choices. Visit megaphone.fm/adchoices