Today we are joined by Subhajeet Singha, Senior Security Researcher at Acronis Threat Research Unit, discussing their work on "Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit." A Chinese-speaking threat actor tracked as Red Heron exploited a critical Gitea remote code execution vulnerability, CVE-2026-60004, within days of its public disclosure, compromising organizations across five countries and stealing source code, credentials, and sensitive infrastructure data.
The campaign involved deploying persistent backdoors and a newly identified Linux implant called JITTERLY, which contains an undocumented rootkit, SIXZUT, capable of hiding files, processes, and network connections while protecting the malware from removal. Acronis assesses with moderate confidence that Red Heron operates within a PRC-linked context, highlighting how quickly attackers can weaponize newly disclosed vulnerabilities and turn exposed development platforms into gateways for broader network compromise. Research Saturday
Today we are joined by Subhajeet Singha, Senior Security Researcher at Acronis Threat Research Unit, discussing their work on "Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit." A Chinese-speaking threat actor tracked as Red Heron exploited a critical Gitea remote code execution vulnerability, CVE-2026-60004, within days of its public disclosure, compromising organizations across five countries and stealing source code, credentials, and sensitive infrastructure data.
The campaign involved deploying persistent backdoors and a newly identified Linux implant called JITTERLY, which contains an undocumented rootkit, SIXZUT, capable of hiding files, processes, and network connections while protecting the malware from removal. Acronis assesses with moderate confidence that Red Heron operates within a PRC-linked context, highlighting how quickly attackers can weaponize newly disclosed vulnerabilities and turn exposed development platforms into gateways for broader network compromise. Research Saturday
Cybersecurity News
Week that Was
CyberWire Daily
Daily Briefing
CyberWire Daily
Story
Caveat
Caveat
Daily Briefing
Hacking Humans
This week, hosts of N2K CyberWire Maria Varmazis and Dave Bittner alongside Joe Carrigan are discussing the latest in social engineering scams, phishing schemes, and criminal exploits that are making headlines. We start with some follow up, including a milestone for Maria’s 100th episode and a listener’s thoughts on whether it should be called “Catch of the Week” instead of “Catch of the Day.” We also revisit FINRA’s Market Data and Investments Explorer. Joe covers a major taxpayer fund scam in Mobile, Alabama, and another report on the growing threat of financial fraud. Maria explores the European Commission’s investigation into Booking.com’s handling of scams, including fake property listings and phishing messages targeting travelers with legitimate reservations. Dave examines a new FTC report showing that reported fraud losses among Americans aged 60 and older have climbed fivefold since 2020, with investment scams, impersonation schemes, and romance scams contributing to devastating financial losses. Our Catch of the Day comes from Michael, who received a phishing email claiming there was a problem with his ChatGPT payment method. The giveaway? He doesn’t have a ChatGPT subscription. 
CyberWire Daily
Story
Business
