Loading malware…
SIXZUT is a Linux user-space rootkit embedded in the JITTERLY implant and associated with the Red Heron threat actor. It is deployed as a shared library masquerading as a legitimate OpenGL component and loaded through LD_PRELOAD. JITTERLY carries the rootkit as an encrypted component that it decrypts and deploys to support stealth and persistence.
SIXZUT hooks 15 Linux library functions to conceal malicious files, processes, and network connections from common monitoring tools. Its hooks cover directory enumeration, file access, metadata retrieval, network operations, and process termination. It obstructs attempts to terminate JITTERLY by making intercepted termination calls report that the protected process does not exist. It can also relaunch JITTERLY after its process stops, provided the implant binary remains present.
SIXZUT was identified in September 2026 in connection with Red Heron's campaign exploiting CVE-2026-60004 in internet-facing Gitea servers. The broader campaign targeted organizations across multiple countries and sectors, including energy, defense, elections, telecommunications, government, and research. Within this toolset, SIXZUT provides concealment and implant protection rather than JITTERLY's command execution, file-transfer, and network-pivoting functionality.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
SIXZUT est un rootkit LD_PRELOAD inédit embarqué dans JITTERLY, qui se dépose sous le nom libglthread.so.2 et masque fichiers, processus et connexions réseau.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
SIXZUT est un rootkit LD_PRELOAD et le contenu identifie le chemin /etc/ld.so.preload.
MITRE ATT&CK catalogs the technique as T1014 under defense evasion.
JITTERLY contient un rootkit embarqué chiffré en AES-128-CTR.
The rootkit drops a 49 KB ELF shared library to disk under the name libglthread.so.2, disguised to look like a legitimate OpenGL threading library.
JITTERLY se déguise sous le nom de processus configd; SIXZUT se dépose sous libglthread.so.2, imitant une bibliothèque OpenGL légitime.
[The framework was] capable of ... removing selected traces; [SIXZUT can] cover up traces of malicious activity and prevent the malware from being detected and killed.
“SIXZUT ... [was] capable of hiding files, processes, and network connections.”
SIXZUT hides files, processes, and network connections... hooks either returns ENOENT or silently skips the directory entry.
SIXZUT est un rootkit LD_PRELOAD et le contenu identifie le chemin /etc/ld.so.preload.
It can also block attempts to terminate the implant and relaunch it when it is removed or stopped.
SIXZUT masque les connexions réseau, y compris via /proc/net/tcp et ss via AF_NETLINK; T1049 est listé parmi les TTPs.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.