Loading malware…
JITTERLY is a C++ Linux ELF backdoor associated with the Red Heron threat actor. It supports more than 30 post-exploitation commands, including shell command execution, file uploads and downloads, process termination, interactive pseudoterminal access, port scanning, SOCKS and TCP tunneling, reverse port forwarding, persistence management, and internal network pivoting. Its command-and-control communications use raw TCP with MessagePack serialization and AES-128-GCM encryption. Its protocol and command structure closely align with the Adaptix C2 framework.
JITTERLY embeds and deploys SIXZUT, an LD_PRELOAD rootkit that hooks Linux library functions to conceal files, processes, and network connections. SIXZUT also obstructs termination of protected processes and can relaunch JITTERLY after it stops, supporting stealth and persistence.
JITTERLY was identified on Red Heron's staging infrastructure during investigation of a multinational campaign exploiting CVE-2026-60004 in internet-facing Gitea servers. The associated campaign involved source-code and credential theft, persistent access, and lateral movement, with confirmed compromises in multiple countries, including Canada, Argentina, Taiwan, the United States, and Sri Lanka. Campaign targeting included defense, elections, energy, aerospace, telecommunications, government, and research organizations.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
JITTERLY est un implant ELF C++ supportant plus de 30 commandes post-exploitation, incluant l’exécution de shell, le transfert de fichiers, le tunneling réseau, un terminal PTY interactif et le pivoting interne.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
When Git later performs an index-related action, the malicious hook executes commands with the permissions of the Gitea service account. JITTERLY supports command execution and interactive terminal sessions.
JITTERLY prend en charge l'exécution de shell et la victime canadienne a présenté un reverse shell.
SIXZUT est un rootkit LD_PRELOAD et le contenu identifie le chemin /etc/ld.so.preload.
SIXZUT est un rootkit LD_PRELOAD inédit embarqué dans JITTERLY, qui masque fichiers, processus et connexions réseau.
JITTERLY contient un rootkit embarqué chiffré en AES-128-CTR.
The rootkit drops a 49 KB ELF shared library to disk under the name libglthread.so.2, disguised to look like a legitimate OpenGL threading library.
JITTERLY se déguise sous le nom de processus configd; SIXZUT se dépose sous libglthread.so.2, imitant une bibliothèque OpenGL légitime.
JITTERLY supports... 22 Timestomp (modify file timestamps).
“SIXZUT ... [was] capable of hiding files, processes, and network connections.”
SIXZUT est un rootkit LD_PRELOAD et le contenu identifie le chemin /etc/ld.so.preload.
It can also block attempts to terminate the implant and relaunch it when it is removed or stopped.
JITTERLY prend en charge le pivoting interne et le contenu liste T1046 parmi les TTPs détectés.
The operator ran a systematic enumeration script that probed the server's temp files, authentication configs, syslog, nginx access logs, bash history, Gitea logs, and nginx configuration.
The networking stack supports SOCKS/TCP tunneling, reverse port forwarding, pivot relaying, and interactive PTY terminals.
JITTERLY prend en charge le tunneling réseau SOCKS/TCP et le pivoting interne.
JITTERLY communique avec son C2 via TCP brut, avec sérialisation msgpack et chiffrement AES-128-GCM.
“JITTERLY ... support[ed] ... file transfer.”
JITTERLY supports more than 30 post-exploitation commands, including shell execution, file transfer, network tunneling, interactive terminal access, and internal pivoting.
“JITTERLY ... support[ed] ... network tunneling ... and internal pivoting.”
JITTERLY communicates with its command-and-control server over raw TCP using encrypted messages.
JITTERLY C2 traffic runs over raw TCP... serialized into msgpack, then encrypted with AES-128-GCM using the per-session key exchanged during registration.
exp_enhanced.py est capable d'exfiltrer les dépôts; JITTERLY dispose de communications C2 TCP brutes et de transfert de fichiers.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.