JITTERLY

malware · malware:jitterly

C++ Linux ELF implant compatible with the Adaptix C2 framework's protocol; communicates over raw TCP using msgpack serialization and AES-128-GCM encryption, and supports more than 30 post-exploitation commands including SOCKS/TCP tunneling, reverse port forwarding, internal pivot relaying and an interactive terminal. Traced by Acronis Threat Research Unit (2026-09-13) to Red Heron's exposed staging server; embeds the SIXZUT rootkit.

Coverage

first 2026-08-30 → last 2026-09-22

Latest activity

2026-09-22

Applying the same patch twice writes an executable into $GIT_DIR of a bare clone, and Git then runs it as the…

Peak priority

high

1 high

Targets

public-sector

sectors: public-sector · regions: europe

Sources cited

3 hosts

Action items (2)

Do-now tasks recorded on the entries about JITTERLY, newest first. Check the date before acting on an older one.

Upgrade every self-hosted Gitea instance to 1.27.1 or later, and on any instance that was internet-reachable on an older build with open registration, rotate what the service account could read: the Gitea configuration file, database credentials, and any OAuth or integration credentials in its process environment. The patch does not undo a prior compromise, and credential exposure is the durable half of this one.
2026-08-30CVE-2026-60004
Audit user accounts created since the instance was last patched and delete the repositories they created. The observed access path is self-registration followed immediately by repository creation, so a recently self-registered account owning one throwaway repository is the artefact to look for.
2026-08-30CVE-2026-60004

Defender insights

What each entry about JITTERLY tells a defender to do, newest first.

2026-08-30HIGHexploitedApplying the same patch twice writes an executable into $GIT_DIR of a bare clone, and Git then runs it as the Gitea user

Latest update · triage

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

related to

SIXZUT
malwaremalware:sixzutevidence · 2026-08-30
SIXZUT ships as an AES-128-CTR-encrypted blob embedded in JITTERLY's own binary, decrypted and loaded by the implant at runtime.

used by

Red Heron
actoractor:red-heronevidence · 2026-08-30
Acronis Threat Research Unit traced the JITTERLY Linux implant to Red Heron's own exposed staging server.

Story timeline

2026-08-30CVE-2026-60004: Gitea's diffpatch endpoint turns an attacker-supplied patch into a live Git hook, giving command execution as the service account; KEV-listed after miner deployment
trending-vulnerabilitiesApplying the same patch twice writes an executable into $GIT_DIR of a bare clone, and Git then runs it as the Gitea user

Hunting pivots

CVEs (exploited first)

CVE-2026-60004

Affected products

Gitea

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-08-30/cve-2026-60004-gitea-diffpatch-git-hook-rce-kev · ATT&CK page ↗

Execution TA0002

T1574.006Hijack Execution Flow: Dynamic Linker Hijacking×1

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from various environment variables and files, such as <code>LD_PRELOAD</code> on Linux or <code>DYLD_INSERT_LIBRARIES</code> on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name. Each platform's linker uses an extensive list of environment variables at different points in execution. These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions in the original library.

Evidence: 2026-08-30/cve-2026-60004-gitea-diffpatch-git-hook-rce-kev · ATT&CK page ↗

Stealth TA0005

T1014Rootkit×1

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.

Evidence: 2026-08-30/cve-2026-60004-gitea-diffpatch-git-hook-rce-kev · ATT&CK page ↗

T1574.006Hijack Execution Flow: Dynamic Linker Hijacking×1

Evidence: 2026-08-30/cve-2026-60004-gitea-diffpatch-git-hook-rce-kev · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-08-30/cve-2026-60004-gitea-diffpatch-git-hook-rce-kev · ATT&CK page ↗

Command and Control TA0011

T1090.001Proxy: Internal Proxy×1

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.

Evidence: 2026-08-30/cve-2026-60004-gitea-diffpatch-git-hook-rce-kev · ATT&CK page ↗

T1095Non-Application Layer Protocol×1

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive. Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).

Evidence: 2026-08-30/cve-2026-60004-gitea-diffpatch-git-hook-rce-kev · ATT&CK page ↗

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-08-30/cve-2026-60004-gitea-diffpatch-git-hook-rce-kev · ATT&CK page ↗

T1572Protocol Tunneling×1

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-08-30/cve-2026-60004-gitea-diffpatch-git-hook-rce-kev · ATT&CK page ↗

Impact TA0040

T1496Resource Hijacking×1

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Evidence: 2026-08-30/cve-2026-60004-gitea-diffpatch-git-hook-rce-kev · ATT&CK page ↗

Entries about JITTERLY (1)

2026-08-30 · view entry permalink →

HIGHCVE-2026-60004exploitedupdatedNATOA1

CVE-2026-60004: Gitea's diffpatch endpoint turns an attacker-supplied patch into a live Git hook, giving command execution as the service account; KEV-listed after miner deployment

CISA added CVE-2026-60004 to the Known Exploited Vulnerabilities catalog on 2026-08-25. The flaw is in services/repository/files/patch.go, the code behind Gitea's diffpatch endpoint, which applies an attacker-controlled patch inside a shared bare temporary clone. The maintainers describe the chain precisely: "submitting the same patch twice creates an add/add collision. Git's three-way fallback checks the indexed path out even though the operation is performed with --cached" (Gitea maintainers, 2026-07-28). In a bare clone the repository root is $GIT_DIR, so a checked-out executable entry whose path matches a Git hook name is not a file sitting next to the hooks directory, it is a hook. Git then invokes it while writing the index, and it runs as the Gitea OS account.

The precondition is the part worth reading twice. The advisory states it plainly: "an attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository" (same advisory). Ordinary write access is not a privileged role, it is what every user of a Git forge has by definition, and Gitea's shipped default hands it to anyone who can reach the login page. So on a default-configured instance this is a pre-authentication flaw in every sense that matters operationally, separated from an anonymous visitor only by a registration form. Fixed in Gitea 1.27.1. The advisory carries a working proof-of-concept, which arrived with it.

Exploitation is opportunistic and automated. Help Net Security reports the incident write-up of an operator whose self-hosted instance was compromised: "because the server ran an outdated version of Gitea, with open user registration and no email confirmation or CAPTCHA, an automated scanner was able to register an account, create its own repository, and trigger the exploit chain" (Help Net Security, 2026-08-26). The chain wrote a proof of execution into a Git branch, then pulled a shell loader followed by a miner; the operator was alerted not by security tooling but by the hosting provider flagging sustained CPU. That is a mass-scanning profile against a default configuration, not targeted intrusion, and it means exposure is a function of being reachable rather than being interesting.

The blast radius is broader than the payload suggests. Depending on container isolation and the privileges of the Gitea OS user, exploitation can expose the main configuration file, application and process-environment secrets, database credentials and contents, and OAuth and integration credentials (same reporting). A miner is the noisy outcome; the quiet one is a set of credentials into whatever the forge is wired to, which for a public-sector development estate typically means CI runners, artefact registries and identity providers.

Where the activity surfaces. The exploitation itself looks like ordinary API traffic, so the durable signal is what the service account does immediately afterwards. Watch for the Gitea service account spawning a shell or an interpreter within seconds of a patch or diff API call, on a host whose normal process tree is a Go binary plus git. On the repository side, the artefact is a Git hook whose content arrived through patch application rather than through an administrator action, so an executable object at a hook path in a repository nobody manages is the thing to hunt for. Registration and repository-creation events are the leading indicator: on an instance with real users, a self-registered account creating a single repository and immediately exercising the diff endpoints is not a normal usage pattern.

Triage: the benign lookalike is a legitimate developer using diffpatch to apply a patch, which is what the endpoint is for and which will be the overwhelming majority of hits on that route. Two things separate exploitation from it. First, the same patch applied twice in quick succession, which is the collision the attack requires and which a human working normally has no reason to produce. Second, and more reliably, what happens next: a legitimate patch application ends with a commit, while this one ends with the service account executing something. Alert on the process behaviour, use the endpoint traffic to explain it.

An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.

Submitting the same patch twice creates an add/add collision. Git's three-way fallback checks the indexed path out even though the operation is performed with --cached.

Gitea maintainers (GitHub Security Advisory) 2026-07-28

Because the server ran an outdated version of Gitea, with open user registration and no email confirmation or CAPTCHA, an automated scanner was able to register an account, create its own repository, and trigger the exploit chain.

Help Net Security 2026-08-26

Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems. Targets were classified using Simplified Chinese labels covering defense, elections, energy, aerospace, telecommunications, government, and research. Confirmed compromises affected organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka.

The staging server also contained JITTERLY, a C++ Linux implant supporting more than 30 post-exploitation commands, including shell execution, file transfer, network tunneling, interactive terminal access, and internal pivoting. Embedded inside it was SIXZUT, a previously undocumented LD_PRELOAD rootkit capable of hiding files, processes, and network connections, preventing the implant from being terminated, and relaunching it if the process is stopped while the binary remains present.

Acronis Threat Research Unit 2026-09-13

Update22 Sep 2026 05:20 UTCrun 2026-09-22T0410Z-intelentitiestechniquestagssourcesevidencebody

Acronis Threat Research Unit documents a second, targeted exploitation of this same vulnerability, distinct from the opportunistic cryptomining incident above: a Chinese-speaking actor it tracks as Red Heron, assessed with moderate confidence to operate in a PRC-linked context, turned public proof-of-concept code into an automated exploitation framework within days of the July 2026 advisory (Acronis Threat Research Unit, 2026-09-13). The actor scanned 1,386 Gitea instances across seven countries and maintained a separate target list of 477 Taiwan-based systems, classifying candidates by sector (defense, elections, energy, aerospace, telecommunications, government and research) and confirmed compromises in Canada, Argentina, Taiwan, the United States and Sri Lanka, including source-code theft, credential collection, SSH-key persistence and lateral movement (Acronis Threat Research Unit, 2026-09-13). In one Taiwanese environment the actor escalated from the Gitea compromise to an obtained Proxmox root authentication ticket, reaching root-level administrative access across a three-node Proxmox cluster and initiating full virtual-machine backup operations that would have exfiltrated complete VM disk images had they completed.

Acronis traced a Linux implant, which it tracks as JITTERLY, to Red Heron's own exposed staging server. JITTERLY is a C++ implant compatible with the Adaptix C2 framework's protocol, communicating over raw TCP with msgpack-serialized, AES-128-GCM-encrypted messages, and supporting more than 30 post-exploitation commands including SOCKS/TCP tunneling, reverse port forwarding, internal pivot relaying and an interactive terminal (Acronis Threat Research Unit, 2026-09-13). Embedded inside JITTERLY as an encrypted blob is a previously undocumented LD_PRELOAD rootkit Acronis tracks as SIXZUT, which hooks libc file, directory, socket and signal-handling functions to hide its own files, hide matching processes from /proc listings, hide matching network connections from /proc/net/* reads and netlink socket queries alike, and re-launch the implant if it is killed while the rootkit's own library remains loaded via /etc/ld.so.preload (Acronis Threat Research Unit, 2026-09-13).

Detection (Red Heron / JITTERLY / SIXZUT specific): an unexplained entry or modification to /etc/ld.so.preload is a strong signal on any Linux host, since this file is normally absent or static; because SIXZUT hides its own artifacts from userland tools, check /etc/ld.so.preload, running-process lists and /proc/net/* contents from a known-good offline image, a different host, or kernel-level/EDR telemetry rather than ls, ps, netstat or ss run on the live host itself. A kill -9 against a hidden PID that returns with no error but leaves the process running is consistent with SIXZUT's signal-hiding hook. On any Gitea instance that also fronts a Proxmox or similar virtualization API, treat a Gitea-stored credential or token reaching that management API as a lateral-movement path, not just a data-exfiltration one.

Defender takeaway (update): the same patch and registration hardening above close both the opportunistic and the targeted exploitation paths; an instance that was internet-reachable and unpatched should now also be checked for the Red Heron / JITTERLY / SIXZUT artifacts above, not only for a cryptominer, since this actor's confirmed objective on comparable targets was credential theft and persistent access rather than resource abuse.

vulnerability30 Aug 13:12Zmulti-sourceOpen finding →

Sources: Gitea maintainers (GitHub Security Advisory) · Help Net Security · Acronis Threat Research Unit

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Gitea×1
productproduct:gitea
Gitea diffpatch endpoint - Git-hook code injection, command execution as the service account, CVSS 9.8; CISA KEV 2026-08-25, fixed in 1.27.1×1
cveCVE-2026-60004
Red Heron×1
actoractor:red-heronlinked
SIXZUT×1
malwaremalware:sixzutlinked

Where this entity is cited

Vulns1

Source distribution

acronis.com1 (33%)
github.com1 (33%)
helpnetsecurity.com1 (33%)

All cited sources (3)