Red Heron Chains CVE-2026-60004 into Automated Gitea Framework, Deploys SIXZUT Rootkit on Proxmox
Red Heron rapidly turned a public Gitea RCE into a multi-country espionage operation that stole source code and achieved root access via a custom Linux rootkit. Technical evidence supports China-linked activity but lacks independent verification of state attribution. The incident highlights the risk of exposed development infrastructure and the speed at which public exploits become persistent implants.
Operational significance lies in the speed of N-day weaponization against self-hosted code platforms. Source-code theft from industrial automation and quantitative-trading firms supplies immediate intelligence value and future supply-chain leverage. Next phase indicators include continued scanning of remaining Gitea instances and lateral movement from compromised Proxmox hosts; defenders should monitor for JITTERLY C2 patterns and SIXZUT function hooks within 30 days.
Acronis TRU: SIXZUT samples will appear in at least three additional public malware repositories within 60 days.
Sources (3)
- [1]Primary Source(https://thehackernews.com/2026/09/red-heron-exploits-gitea-rce-to.html)
- [2]Supporting Source(https://acronis.com/en-us/blog/threat-research/red-heron-gitea-campaign)
- [3]Supporting Source(https://github.com/dmpdump/JITTERLY-analysis)