The long road to root. [Research Saturday]

Host Dave Bittner introduces Subhajeet Singha, a senior security researcher with Acronis's Threat Research Unit, to discuss the report “Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit.” Singha says Acronis routinely hunts for threats—including AI-related threats and activity by advanced persistent threats, particularly those involving the Middle East. During that work, researchers had been tracking a small implant for about six months, internally called SIXZUT, spelled S-I-X-Z-U-T. While looking for SIXZUT across open directories and other telemetry, the team found an interesting exposed directory associated with Red Heron. Researchers “basically took apart the entire open directory” and found what appeared to be the threat actor's operational arsenal: targeting scripts, command-and-control material, malware, and sensitive data. The directory contained the SIXZUT implant and led researchers to connect it with SIGZERT, an implant previously identified by another researcher under a different name. The important development was that SIGZERT appeared to be trying to deploy a rootkit. Acronis concluded that victims compromised in the campaign received both the JITTERLY implant and the SIXZUT rootkit, making the exposed directory a window into the actor's preparation, targeting, and post-compromise activity.

Bittner asks why Acronis describes Red Heron as a Chinese-speaking threat actor with moderate confidence. Singha says attribution is treated cautiously because other researchers may build on the work, so Acronis looks for several independent indicators rather than relying on a single artifact. The team found scripts and comments written in Mandarin, specifically language associated with the People's Republic of China rather than Taiwan. The actor also targeted Taiwan, which Singha presents as another important clue. The researchers saw similarities to Chinese threat actors already tracked by Acronis, including a tendency to weaponize newly disclosed vulnerabilities quickly. Singha also points to earlier attribution of Gitea-related activity to a Chinese threat actor, along with similarities in command-and-control infrastructure, other artifacts, exfiltration behavior, and victimology. Together, those clues led Acronis to assess that Red Heron was based in China or operated in a Chinese-speaking context, but only with moderate confidence. The assessment is therefore presented as a combination of language, targeting, technical behavior, and infrastructure evidence—not as a definitive claim about government control or sponsorship.

Asked how much of Red Heron's capability was custom, Singha says the operation used a mixture of bespoke malware and open-source components. Among the custom material were source-code projects that appeared to be intended for later compilation and use, the JITTERLY implant, the SIXZUT rootkit, and scripts for targeting and deployment. The rootkit and loader were especially important because they gave the actor a persistent post-exploitation capability rather than merely providing an initial vulnerability exploit. The open-source side included proof-of-concept code for vulnerability scanning and other tools used to identify and track potential victims. Singha says Red Heron also prepared command-and-control infrastructure for later campaign stages. In addition to exploiting the Gitea vulnerability, the actor weaponized an older Joomla vulnerability disclosed in 2026, using public proof-of-concept material to scan and target organizations. The overall conclusion was not that Red Heron built everything from scratch, but that it combined readily available scanning and exploitation resources with custom loaders, implants, scripts, and rootkit functionality. That balance let the actor move quickly while retaining specialized capabilities for persistence, concealment, and control.

Singha describes two related campaigns. In the Joomla campaign, Red Heron targeted organizations in Brazil, Paraguay, the United States, India, Bhutan, and other locations. The victims included small entities, individual businesses, and organizations in sectors such as energy, which Singha calls notable because APT activity is often associated primarily with espionage. In the Gitea campaign, the actor specifically targeted Canada, Argentina, Taiwan, the United States, and Sri Lanka, and Acronis found evidence that data was exfiltrated from organizations in those regions. Canada appeared to be the most affected location: nearly two energy-sector companies were compromised, according to Singha. In Argentina, a prominent trading firm was targeted, received backdoors, and had the SIXZUT rootkit deployed. In Taiwan, Red Heron attacked energy-related targets but also compromised victims' virtual machines, going beyond the expected target systems. The actor also targeted Canadian e-learning websites and services, exfiltrating data it considered useful, and compromised a small IT company in Sri Lanka. Researchers found targeting notes with names such as “to be targeted” and “confirm vulnerability.” Those notes referenced civic, political, and voting services in the United States and Canada. A log referred to an attempted attack on a U.S. voting database, but the researchers did not confirm successful exfiltration or deployment there. Singha therefore distinguishes intended targets from confirmed compromises.

Bittner asks Singha to rate Red Heron's sophistication. Singha calls it “pretty sophisticated,” citing a custom loader or implant with anti-analysis features, exploitation and post-exploitation commands, and the ability to deploy the rootkit. Once on a victim machine, the actor could open a new shell, transfer files, and scan ports. The rootkit was carried inside the loader, allowing the threat actor to introduce it as part of the compromise rather than retrieve every component separately. Singha says JITTERLY and SIXZUT were technically sophisticated in particular. SIXZUT hooks system functions and hides files, processes, and network connections from userland and antimalware tools. That concealment helps the malware persist and makes investigation or removal more difficult. Singha also says the actor used artificial intelligence to write proof-of-concept code, helping it begin targeting organizations quickly after vulnerabilities became public. The episode's central technical lesson is that Red Heron's danger came from combining rapid vulnerability weaponization with a custom implant and rootkit that could maintain stealth after initial access.

For defenders, Singha's first recommendation is to patch Gitea instances and avoid exposing older or vulnerable versions directly to the internet. Organizations that cannot eliminate exposure should place access behind a VPN, authentication, or a reverse proxy. The advice is aimed at the initial-access path that Red Heron repeatedly abused: a critical Gitea remote-code-execution vulnerability that attackers weaponized soon after public disclosure. To determine whether a system was affected, Singha recommends checking `/etc/ld.so.preload`, where defenders may find evidence that the rootkit was installed. He also points to the indicators of compromise Acronis released, including command-and-control indicators, and recommends reviewing network telemetry for related activity. In short, the defensive approach is both preventative and investigative: patch and restrict Gitea, then use the published IOCs and host-level checks to look for JITTERLY, SIXZUT, and associated infrastructure. The interview closes by emphasizing that keeping internet-facing development platforms current is the simplest and most important mitigation against this campaign.