Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit
Excerpt
A suspected Chinese-speaking threat actor tracked as Red Heron is exploiting the critical Gitea remote code execution vulnerability tracked as CVE-2026-60004. The operation targeted internet-exposed source-code servers, enabling the theft of proprietary repositories and deployment of the JITTERLY Linux backdoor alongside the stealth-focused SIXZUT rootkit. Acronis Threat Research Unit reported that Red Heron rapidly weaponized the Gitea flaw, affecting versions 1.17 through…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-60004 | High | Score 81/100 | First seen |
| Domain | 981666.xyz | High | Score 69/100 | First seen |
IOC Relationship Graph
Building graph…