{ "intelligence": { "actors": [ { "confidence": 50, "evidence_id": "de168914-bbff-4016-a3a5-eb8f99c63ed3", "name": "Red Heron", "role": "acteur lié (relation targets)", "type": "Intrusion-Set" } ], "counts": { "actors": 1, "associated_entity_contexts": 0, "deduplicated_iocs": 5, "direct_entities": 31, "direct_relationships": 66, "invalid_iocs": 2, "iocs": 5, "mentioned": 5, "mitre_associated": 0, "mitre_direct": 0, "targets": 9, "techniques": 0, "unsupported_indicators": 4, "vulnerabilities": 1 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 106, "excluded_graph_objects": 260, "graph_complete": true, "graph_objects": 31, "graph_relationships": 66, "mitre_context_complete": true, "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "status_as_of": "2026-10-10T20:46:32+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T07:06:37.879Z", "updated_at": "2026-09-26T07:06:38.318Z" }, "description_available": false, "entity_type": "StixFile", "id": "05c13330-545d-4049-8b45-b24c40697069", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "file--79742919-8d84-58cd-8597-e5bf1cf6ae58", "type": "StixFile" }, { "__typename": "Sector", "aliases": [ "Communications", "Telecom", "Telecommunication", "Telecoms" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.395Z", "created_at": "2026-01-18T14:35:13.791Z", "modified": "2026-03-01T15:18:16.401Z", "updated_at": "2026-03-01T15:18:16.401Z" }, "description_available": true, "entity_type": "Sector", "id": "08257c10-e1ae-4471-bc3f-251792c1126c", "is_inferred": false, "labels": [], "lang": "en", "name": "Telecommunications", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--4b68fb1a-ff8b-5bef-8d2a-0e477b3ad78e", "type": "Sector" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.667Z", "created_at": "2026-09-26T07:06:29.930Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T07:06:34.816Z", "updated_at": "2026-09-26T07:06:34.816Z" }, "description_available": false, "entity_type": "Malware", "id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "is_inferred": false, "labels": [], "lang": "en", "name": "JITTERLY", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "malware--b56a977c-a02d-5f26-a0ac-8dfade873a42", "type": "Malware" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T07:06:40.568Z", "updated_at": "2026-09-26T07:06:41.978Z" }, "description_available": false, "entity_type": "Hostname", "id": "0ae9091d-fac8-4e54-a994-00fd7d28f564", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "hostname--1a5ab04e-55a6-5140-ade7-a8bc9ae67876", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T07:06:38.035Z", "updated_at": "2026-09-26T07:06:38.471Z" }, "description_available": false, "entity_type": "StixFile", "id": "0c0112f5-e12e-49cc-8f54-7220f52bd079", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "file--dc773db3-ff72-5990-b9b0-b454eee578d9", "type": "StixFile" }, { "__typename": "Sector", "aliases": [ "Bitcoin", "Crypto", "Cryptocurrency", "Currency Exchange", "IT", "Information Security", "Software Development", "Technology", "Virtual Currency", "Vulnerability Research", "software" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.394Z", "created_at": "2026-01-18T14:35:11.762Z", "modified": "2026-03-09T09:41:22.635Z", "updated_at": "2026-03-09T09:41:22.635Z" }, "description_available": true, "entity_type": "Sector", "id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "is_inferred": false, "labels": [], "lang": "en", "name": "Technologies", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--dcacaabc-1244-51fd-8e75-59f4a6fe0aad", "type": "Sector" }, { "__typename": "Sector", "aliases": [ "Charitable Organizations", "Environmental", "Human Rights", "Humanitarian", "NGO", "Non-Profit" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.396Z", "created_at": "2026-01-18T14:35:16.788Z", "modified": "2026-03-02T08:10:37.845Z", "updated_at": "2026-03-02T08:10:37.845Z" }, "description_available": true, "entity_type": "Sector", "id": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "is_inferred": false, "labels": [], "lang": "en", "name": "Non-Governmental Organizations (NGOs)", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--35e12adc-e1a7-569a-a43f-76ac93cc5885", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.747Z", "created_at": "2026-09-26T07:06:40.874Z", "modified": "2026-09-26T07:06:45.067Z", "updated_at": "2026-09-26T07:06:45.067Z" }, "description_available": false, "entity_type": "Indicator", "id": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "indicator--2c81e5a1-9fd3-5839-a85a-4572faf8a865", "type": "Indicator" }, { "__typename": "Vulnerability", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 80, "created_by": null, "dates": { "created": "2026-08-25T00:00:00.000Z", "created_at": "2026-08-26T15:55:38.751Z", "modified": "2026-09-26T07:06:37.356Z", "updated_at": "2026-09-26T07:06:37.356Z" }, "description_available": true, "entity_type": "Vulnerability", "id": "31b901d5-1e5f-4752-9173-f0144572ec05", "is_inferred": false, "labels": [], "lang": "en", "name": "CVE-2026-60004", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "CVE-2026-60004", "id": "47df4162-0d7e-487a-8dd5-1fbd5bf5a10c", "source_name": "NIST NVD", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60004" }, { "external_id": null, "id": "4c04e3de-0729-4b54-af54-1353be914789", "source_name": "cve@mitre.org", "url": "https://blog.gitea.com/release-of-1.27.1/" }, { "external_id": null, "id": "630706fa-d851-49d1-8206-59efdb184d26", "source_name": "cve@mitre.org", "url": "https://github.com/0xBlackash/CVE-2026-60004" }, { "external_id": null, "id": "68819043-5927-40b1-b0c0-d7bf73500522", "source_name": "cve@mitre.org", "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m" }, { "external_id": null, "id": "a5da9602-56e6-4cb4-9bf1-b27d4d824c0f", "source_name": "cve@mitre.org", "url": "https://www.runzero.com/blog/gitea/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "vulnerability--9014223b-8b57-5f93-a8c1-c137dafaa61d", "type": "Vulnerability" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.762Z", "created_at": "2026-09-26T07:06:45.801Z", "modified": "2026-09-26T07:06:58.071Z", "updated_at": "2026-09-26T07:06:58.071Z" }, "description_available": false, "entity_type": "Indicator", "id": "453eabf2-9336-478c-a4b5-67df2e77e8b4", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "indicator--f50269af-b64e-5c13-9132-e09c7b77b7dc", "type": "Indicator" }, { "__typename": "Sector", "aliases": [ "Financial", "Financial Industry (FI)", "Financial Services", "Financial-Services" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.391Z", "created_at": "2026-01-18T14:35:07.063Z", "modified": "2026-01-22T20:49:24.280Z", "updated_at": "2026-01-22T20:49:24.280Z" }, "description_available": true, "entity_type": "Sector", "id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "is_inferred": false, "labels": [], "lang": "en", "name": "Finance", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--283d4ea0-b6f1-5421-bdab-117a33fdb2b7", "type": "Sector" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.668Z", "created_at": "2026-09-26T07:06:35.549Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T07:06:35.973Z", "updated_at": "2026-09-26T07:06:35.973Z" }, "description_available": false, "entity_type": "Malware", "id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "is_inferred": false, "labels": [], "lang": "en", "name": "SIXZUT", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "malware--2de0a2e7-8343-5740-887f-b1839d0992bc", "type": "Malware" }, { "__typename": "Sector", "aliases": [ "Defence", "National Security" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.390Z", "created_at": "2026-01-18T14:35:06.351Z", "modified": "2026-02-22T09:57:31.072Z", "updated_at": "2026-02-22T09:57:31.072Z" }, "description_available": true, "entity_type": "Sector", "id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "is_inferred": false, "labels": [], "lang": "en", "name": "Defense", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--a60aa444-a004-5549-9dcf-5798d82b34da", "type": "Sector" }, { "__typename": "Sector", "aliases": [ "Natural Resources" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.389Z", "created_at": "2026-01-18T14:35:03.684Z", "modified": "2026-02-26T16:33:30.302Z", "updated_at": "2026-02-26T16:33:30.302Z" }, "description_available": true, "entity_type": "Sector", "id": "88a987fb-6fbd-444b-91ec-f52b5696e123", "is_inferred": false, "labels": [], "lang": "en", "name": "Energy", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--166544e2-ba1f-5a6c-89cf-a63d0c01e91c", "type": "Sector" }, { "__typename": "Sector", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.388Z", "created_at": "2026-01-18T14:35:02.955Z", "modified": "2026-01-20T20:57:28.767Z", "updated_at": "2026-01-20T20:57:28.767Z" }, "description_available": true, "entity_type": "Sector", "id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "is_inferred": false, "labels": [], "lang": "en", "name": "Education", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--2b0657c7-cf11-5d30-8867-4c6d9dd99270", "type": "Sector" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T07:06:39.866Z", "updated_at": "2026-09-26T07:06:40.371Z" }, "description_available": false, "entity_type": "Hostname", "id": "8f7c40eb-d746-4ecf-ade2-7c3f6ef67580", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "hostname--952a664d-bb02-52c1-b8a5-55e6f0514847", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T07:06:37.900Z", "updated_at": "2026-09-26T07:06:38.472Z" }, "description_available": false, "entity_type": "StixFile", "id": "96d09e40-4d30-488f-9c06-ad12b963a6db", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "file--10bc84a5-b34d-549a-aa5a-29704ce1148d", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T07:06:38.987Z", "updated_at": "2026-09-26T07:06:39.690Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "9912b23a-2e30-4c66-a347-babccb5ac377", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "domain-name--cfcb9b29-a8fa-5f35-93ea-066f4a4e1b6e", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.755Z", "created_at": "2026-09-26T07:06:43.770Z", "modified": "2026-09-26T07:06:54.209Z", "updated_at": "2026-09-26T07:06:54.209Z" }, "description_available": false, "entity_type": "Indicator", "id": "9aa9e02a-6f46-458b-908a-db59f639a093", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "indicator--398c0c6c-1528-53da-9bdb-10eb8d056405", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Url", "x_opencti_score": 20 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.757Z", "created_at": "2026-09-26T07:06:44.551Z", "modified": "2026-10-05T18:40:41.625Z", "updated_at": "2026-10-05T18:40:41.625Z" }, "description_available": false, "entity_type": "Indicator", "id": "aa501976-e35e-4368-b846-c17c548b3213", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "indicator--bad65895-fd43-5df5-b595-1d8756d6ec2c", "type": "Indicator" }, { "__typename": "Sector", "aliases": [ "Aerospace", "Airline", "Aviation", "Satellite", "Satellite and communications" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.390Z", "created_at": "2026-01-18T14:35:05.210Z", "modified": "2026-03-03T16:11:36.002Z", "updated_at": "2026-03-03T16:11:36.002Z" }, "description_available": true, "entity_type": "Sector", "id": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "is_inferred": false, "labels": [], "lang": "en", "name": "Air transport", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--f70238bb-1aaa-57af-800b-91806caa8abb", "type": "Sector" }, { "__typename": "IntrusionSet", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.666Z", "created_at": "2026-09-26T07:06:29.770Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T07:06:32.642Z", "updated_at": "2026-09-26T07:06:32.642Z" }, "description_available": false, "entity_type": "Intrusion-Set", "id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "is_inferred": false, "labels": [], "lang": "en", "name": "Red Heron", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "intrusion-set--b5dc822d-7468-5d6a-8d96-00507532d0eb", "type": "IntrusionSet" }, { "__typename": "Sector", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.396Z", "created_at": "2026-01-18T14:35:16.665Z", "modified": "2026-01-18T14:35:16.847Z", "updated_at": "2026-01-18T14:35:16.847Z" }, "description_available": true, "entity_type": "Sector", "id": "b9a0dfa4-df11-4fbb-b4ac-04f7e6d5c481", "is_inferred": false, "labels": [], "lang": "en", "name": "Civil society", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--ec578e61-1405-5026-ac57-d940919605c6", "type": "Sector" }, { "__typename": "Sector", "aliases": [ "Shipping", "Transportation" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.390Z", "created_at": "2026-01-18T14:35:04.772Z", "modified": "2026-01-25T08:44:52.215Z", "updated_at": "2026-01-25T08:44:52.215Z" }, "description_available": true, "entity_type": "Sector", "id": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "is_inferred": false, "labels": [], "lang": "en", "name": "Transport", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--4a5a8971-1cd1-5a11-8843-267e17b105ac", "type": "Sector" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T07:06:38.830Z", "updated_at": "2026-09-26T07:06:39.139Z" }, "description_available": false, "entity_type": "StixFile", "id": "c29133f5-d963-4a56-b0f6-cdf0383b87e9", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "file--48cc88d0-3206-5802-a18e-ca48883eb2ca", "type": "StixFile" }, { "__typename": "Url", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T07:06:38.947Z", "updated_at": "2026-09-26T07:06:39.457Z" }, "description_available": false, "entity_type": "Url", "id": "d029cbbc-c0e8-4b75-9fa0-87f4b7470a16", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "url--237630fe-c96f-58df-a47d-8fcba8b3ca46", "type": "Url" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.760Z", "created_at": "2026-09-26T07:06:45.164Z", "modified": "2026-09-26T07:07:01.001Z", "updated_at": "2026-09-26T07:07:01.001Z" }, "description_available": false, "entity_type": "Indicator", "id": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "indicator--ee5093ab-b037-583c-a9fc-8e2d9bdadfbe", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.765Z", "created_at": "2026-09-26T07:06:47.772Z", "modified": "2026-09-26T07:07:05.927Z", "updated_at": "2026-09-26T07:07:05.927Z" }, "description_available": false, "entity_type": "Indicator", "id": "d6631331-c2af-475c-bbfc-1dd19274a8cd", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "indicator--8fa33206-511d-5e74-aa96-1ac6e5672fd9", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.752Z", "created_at": "2026-09-26T07:06:43.165Z", "modified": "2026-09-26T07:06:50.877Z", "updated_at": "2026-09-26T07:06:50.877Z" }, "description_available": false, "entity_type": "Indicator", "id": "df25fce2-21fb-4a13-be61-c48255d50cd8", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "indicator--9458db39-8c3a-5f00-a0c7-46f9054fdf4c", "type": "Indicator" }, { "__typename": "Sector", "aliases": [ "Election", "Government", "Voting" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.392Z", "created_at": "2026-01-18T14:35:09.055Z", "modified": "2026-01-22T08:00:46.641Z", "updated_at": "2026-01-22T08:00:46.641Z" }, "description_available": true, "entity_type": "Sector", "id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "is_inferred": false, "labels": [], "lang": "en", "name": "Government and administrations", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "identity--9d697b63-6ae0-5ddb-ae26-e3d6e03302e1", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.750Z", "created_at": "2026-09-26T07:06:42.466Z", "modified": "2026-09-26T07:06:49.336Z", "updated_at": "2026-09-26T07:06:49.336Z" }, "description_available": false, "entity_type": "Indicator", "id": "f848995d-bb15-4202-807a-6747fa1f9ab6", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "indicator--88d2648c-26e6-5413-95f5-40137405fd0c", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.725Z", "created_at": "2026-09-26T07:07:09.246Z", "modified": "2026-09-26T07:07:09.526Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:09.526Z" }, "description_available": false, "entity_type": "targets", "fromId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_name": "JITTERLY", "from_type": "Malware", "id": "00d69c33-508f-4bfc-8adb-cbb24422e139", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--4bdc7c69-afcf-5295-a2ed-48a64715434d", "toId": "88a987fb-6fbd-444b-91ec-f52b5696e123", "to_id": "88a987fb-6fbd-444b-91ec-f52b5696e123", "to_name": "Energy", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.728Z", "created_at": "2026-09-26T07:07:09.291Z", "modified": "2026-09-26T07:07:09.876Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:09.876Z" }, "description_available": false, "entity_type": "targets", "fromId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_name": "SIXZUT", "from_type": "Malware", "id": "00e1f632-e88b-47b9-a794-eca73441f1d8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--2b0f80b1-047b-5054-849c-227b6a533b03", "toId": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_name": "Defense", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.846Z", "created_at": "2026-09-26T07:11:50.201Z", "modified": "2026-09-26T07:11:50.612Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:11:50.612Z" }, "description_available": false, "entity_type": "indicates", "fromId": "453eabf2-9336-478c-a4b5-67df2e77e8b4", "from_id": "453eabf2-9336-478c-a4b5-67df2e77e8b4", "from_name": null, "from_type": "Indicator", "id": "022b7faa-ec1c-484d-9988-1bda121e0b87", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--212ca738-53b1-5260-a5c7-371a91f9caf0", "toId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_name": "JITTERLY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.720Z", "created_at": "2026-09-26T07:06:49.433Z", "modified": "2026-09-26T07:06:49.855Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:49.855Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "08439aa1-f0c6-4e7b-a2f8-90a6833d465c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--ddf2c349-94c2-59c2-9faf-fc398b8c6832", "toId": "88a987fb-6fbd-444b-91ec-f52b5696e123", "to_id": "88a987fb-6fbd-444b-91ec-f52b5696e123", "to_name": "Energy", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.846Z", "created_at": "2026-09-26T07:11:49.437Z", "modified": "2026-09-26T07:11:49.769Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:11:49.769Z" }, "description_available": false, "entity_type": "indicates", "fromId": "453eabf2-9336-478c-a4b5-67df2e77e8b4", "from_id": "453eabf2-9336-478c-a4b5-67df2e77e8b4", "from_name": null, "from_type": "Indicator", "id": "092950f1-b5cd-49b0-baa6-a06e66005d05", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--e47cf20f-98d7-58b0-bd4a-42d864707189", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.726Z", "created_at": "2026-09-26T07:07:07.364Z", "modified": "2026-09-26T07:07:07.990Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:07.990Z" }, "description_available": false, "entity_type": "targets", "fromId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_name": "JITTERLY", "from_type": "Malware", "id": "0bc30f80-e8fa-4002-bb93-0e2e8640a575", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--4ae02139-4bde-52c3-91fc-ec8862e3b1b0", "toId": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_name": "Education", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.730Z", "created_at": "2026-09-26T07:07:11.618Z", "modified": "2026-09-26T07:07:12.006Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:12.006Z" }, "description_available": false, "entity_type": "targets", "fromId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_name": "SIXZUT", "from_type": "Malware", "id": "101bc104-b5d9-45a5-8228-135bc6a46338", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--06cf6027-6cf5-5cce-a01c-f181089b9900", "toId": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_id": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_name": "Air transport", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.722Z", "created_at": "2026-09-26T07:07:01.156Z", "modified": "2026-09-26T07:07:01.550Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:01.550Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "10e0c02a-3f9a-4075-9404-d7d510b62a45", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--cc1813c4-cf78-562c-ad6d-0ee1918c943a", "toId": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_name": "Education", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.725Z", "created_at": "2026-09-26T07:07:00.366Z", "modified": "2026-09-26T07:07:01.108Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:01.108Z" }, "description_available": false, "entity_type": "targets", "fromId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_name": "JITTERLY", "from_type": "Malware", "id": "1181d036-ebab-46f5-b59f-2d0c78523493", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--8ff31e6e-6199-59bc-a7f5-5ba285bad5f7", "toId": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_id": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_name": "Air transport", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.735Z", "created_at": "2026-09-26T07:08:44.868Z", "modified": "2026-09-26T07:08:45.086Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:45.086Z" }, "description_available": false, "entity_type": "targets", "fromId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_name": "SIXZUT", "from_type": "Malware", "id": "12034af0-43cb-409e-9e4a-62ece56d7c91", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--b05c8889-7e47-5834-ab21-ee8d42124233", "toId": "31b901d5-1e5f-4752-9173-f0144572ec05", "to_id": "31b901d5-1e5f-4752-9173-f0144572ec05", "to_name": "CVE-2026-60004", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.780Z", "created_at": "2026-09-26T07:09:19.268Z", "modified": "2026-09-26T07:09:19.523Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:09:19.523Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f848995d-bb15-4202-807a-6747fa1f9ab6", "from_id": "f848995d-bb15-4202-807a-6747fa1f9ab6", "from_name": null, "from_type": "Indicator", "id": "1e1d5eb4-529a-4f29-8872-c0dcf2c20d76", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--a7463c29-1e6f-5600-b936-1e3415c97ba1", "toId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_name": "SIXZUT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.766Z", "created_at": "2026-09-26T07:08:58.628Z", "modified": "2026-09-26T07:08:59.256Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:59.256Z" }, "description_available": false, "entity_type": "indicates", "fromId": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "from_id": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "from_name": null, "from_type": "Indicator", "id": "28197e44-2876-4df4-b81f-6957f40f6e08", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--db16910d-5d26-558f-b9d8-7bf5bec95a77", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.730Z", "created_at": "2026-09-26T07:07:19.355Z", "modified": "2026-09-26T07:07:19.611Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:19.611Z" }, "description_available": false, "entity_type": "targets", "fromId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_name": "SIXZUT", "from_type": "Malware", "id": "2aec496a-66de-4aa6-8b21-9b68c534e48d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--a6d53784-e697-5a4c-b4d8-236d72873868", "toId": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_id": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_name": "Telecommunications", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.397Z", "created_at": "2026-01-18T14:35:37.137Z", "modified": "2026-01-18T14:35:37.380Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:35:37.380Z" }, "description_available": true, "entity_type": "part-of", "fromId": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "from_id": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "from_name": "Non-Governmental Organizations (NGOs)", "from_type": "Sector", "id": "2b7eec33-dc51-4b8c-a2a6-349d7fae0de9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "part-of", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--aa02dc7b-9a22-5d7f-9e58-bba56b230964", "toId": "b9a0dfa4-df11-4fbb-b4ac-04f7e6d5c481", "to_id": "b9a0dfa4-df11-4fbb-b4ac-04f7e6d5c481", "to_name": "Civil society", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.832Z", "created_at": "2026-09-26T07:11:33.277Z", "modified": "2026-09-26T07:11:35.385Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:11:35.385Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "from_id": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "from_name": null, "from_type": "Indicator", "id": "2d0f3372-a5fe-4092-a80a-d6d5224ad530", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--b6111b90-f04d-574e-9ef7-10a12f652011", "toId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_name": "SIXZUT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.721Z", "created_at": "2026-09-26T07:06:52.216Z", "modified": "2026-09-26T07:06:53.699Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:53.699Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "2ec90f23-8cc6-40af-89e1-34c270b68fe4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--d5eeb2df-9f09-56a4-9040-ea9d6eee5400", "toId": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_id": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "to_name": "Air transport", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.767Z", "created_at": "2026-09-26T07:08:59.851Z", "modified": "2026-09-26T07:09:00.213Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:09:00.213Z" }, "description_available": false, "entity_type": "indicates", "fromId": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "from_id": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "from_name": null, "from_type": "Indicator", "id": "3004f498-f341-4321-8426-efa90a87c764", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--856c5a81-622d-5502-a05e-5f631917a915", "toId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_name": "JITTERLY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.779Z", "created_at": "2026-09-26T07:09:24.480Z", "modified": "2026-09-26T07:09:24.683Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:09:24.683Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f848995d-bb15-4202-807a-6747fa1f9ab6", "from_id": "f848995d-bb15-4202-807a-6747fa1f9ab6", "from_name": null, "from_type": "Indicator", "id": "33165e78-3a54-4dd5-bb5a-427d05d01c0c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--8d515154-8113-5baf-91c1-e2b2aac9f48a", "toId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_name": "JITTERLY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.847Z", "created_at": "2026-09-26T07:11:59.119Z", "modified": "2026-09-26T07:11:59.264Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:11:59.264Z" }, "description_available": false, "entity_type": "indicates", "fromId": "453eabf2-9336-478c-a4b5-67df2e77e8b4", "from_id": "453eabf2-9336-478c-a4b5-67df2e77e8b4", "from_name": null, "from_type": "Indicator", "id": "3a8ccd9b-223a-47ca-9364-f2008f3f0837", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--499a4f8b-5fff-52ea-a8ba-5874367dcaf3", "toId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_name": "SIXZUT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.766Z", "created_at": "2026-09-26T07:08:58.629Z", "modified": "2026-09-26T07:08:59.254Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:59.254Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d6631331-c2af-475c-bbfc-1dd19274a8cd", "from_id": "d6631331-c2af-475c-bbfc-1dd19274a8cd", "from_name": null, "from_type": "Indicator", "id": "3ad308ce-a53f-4282-aaf5-a8d714b640c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--e2027de9-6add-56c7-982f-6841729d50af", "toId": "0ae9091d-fac8-4e54-a994-00fd7d28f564", "to_id": "0ae9091d-fac8-4e54-a994-00fd7d28f564", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.733Z", "created_at": "2026-09-26T07:07:20.843Z", "modified": "2026-09-26T07:07:21.081Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:21.081Z" }, "description_available": false, "entity_type": "targets", "fromId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_name": "SIXZUT", "from_type": "Malware", "id": "3af5827a-4ee5-4f91-b9f1-ff494daffdca", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--6fbad191-66d2-5f64-80c1-29c0750f1592", "toId": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_id": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_name": "Non-Governmental Organizations (NGOs)", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.729Z", "created_at": "2026-09-26T07:07:10.688Z", "modified": "2026-09-26T07:07:11.001Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:11.001Z" }, "description_available": false, "entity_type": "targets", "fromId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_name": "SIXZUT", "from_type": "Malware", "id": "3fa09c29-3c42-44ed-b644-9d17a23dc8f7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--9b15da42-fd5a-5002-b7d2-af46e3aeb654", "toId": "88a987fb-6fbd-444b-91ec-f52b5696e123", "to_id": "88a987fb-6fbd-444b-91ec-f52b5696e123", "to_name": "Energy", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.764Z", "created_at": "2026-09-26T07:08:58.430Z", "modified": "2026-09-26T07:08:58.988Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:58.988Z" }, "description_available": false, "entity_type": "based-on", "fromId": "453eabf2-9336-478c-a4b5-67df2e77e8b4", "from_id": "453eabf2-9336-478c-a4b5-67df2e77e8b4", "from_name": null, "from_type": "Indicator", "id": "43735f40-8602-492c-8aa3-5e5a7ad16a94", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--1f6ace3c-b152-5bda-b774-48e12850c5a3", "toId": "8f7c40eb-d746-4ecf-ade2-7c3f6ef67580", "to_id": "8f7c40eb-d746-4ecf-ade2-7c3f6ef67580", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.731Z", "created_at": "2026-09-26T07:07:13.080Z", "modified": "2026-09-26T07:07:13.284Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:13.284Z" }, "description_available": false, "entity_type": "targets", "fromId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_name": "SIXZUT", "from_type": "Malware", "id": "49dedd44-df6f-4b30-9eca-2a3ebfd866d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--891f6d7a-0347-5a50-a107-ac5b52f4906e", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.721Z", "created_at": "2026-09-26T07:06:50.593Z", "modified": "2026-09-26T07:06:50.780Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:50.780Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "4bca8f9a-e920-4a9f-8239-920aea2e00b1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--200dd4d2-2b04-5777-9770-3c74b34a07d4", "toId": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_id": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_name": "Telecommunications", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.790Z", "created_at": "2026-09-26T07:09:37.014Z", "modified": "2026-09-26T07:09:37.323Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:09:37.323Z" }, "description_available": false, "entity_type": "indicates", "fromId": "df25fce2-21fb-4a13-be61-c48255d50cd8", "from_id": "df25fce2-21fb-4a13-be61-c48255d50cd8", "from_name": null, "from_type": "Indicator", "id": "534f7082-e448-44f4-bf1c-b853f53b88de", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--a3ef95e4-da47-5599-a4ff-9517a36a97ca", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.724Z", "created_at": "2026-09-26T07:06:59.305Z", "modified": "2026-09-26T07:06:59.593Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:59.593Z" }, "description_available": false, "entity_type": "targets", "fromId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_name": "JITTERLY", "from_type": "Malware", "id": "57b1ddec-b67b-4760-b672-4ae2d598974b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--4f6218ba-1606-557d-803a-1be7ca48094d", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.723Z", "created_at": "2026-09-26T07:06:57.034Z", "modified": "2026-09-26T07:06:57.271Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:57.271Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "5d5edf46-580f-4ddc-9714-d47dd3d11a32", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--00015eca-5ecc-515a-98bb-1d89bf0b86ae", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.761Z", "created_at": "2026-09-26T07:08:56.853Z", "modified": "2026-09-26T07:08:58.157Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:58.157Z" }, "description_available": false, "entity_type": "based-on", "fromId": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "from_id": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "from_name": null, "from_type": "Indicator", "id": "60a84383-3a6a-4e6f-b084-97e43962b00c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--d2c463e8-ee44-5506-81fb-0d4b6526d951", "toId": "9912b23a-2e30-4c66-a347-babccb5ac377", "to_id": "9912b23a-2e30-4c66-a347-babccb5ac377", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.732Z", "created_at": "2026-09-26T07:07:13.608Z", "modified": "2026-09-26T07:07:14.113Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:14.113Z" }, "description_available": false, "entity_type": "targets", "fromId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_name": "SIXZUT", "from_type": "Malware", "id": "634a5856-88cf-49ef-8c90-dad72d61b361", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--60eac94e-6ef8-5033-853d-4e0659a5db73", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.791Z", "created_at": "2026-09-26T07:09:39.713Z", "modified": "2026-09-26T07:09:40.521Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:09:40.521Z" }, "description_available": false, "entity_type": "indicates", "fromId": "df25fce2-21fb-4a13-be61-c48255d50cd8", "from_id": "df25fce2-21fb-4a13-be61-c48255d50cd8", "from_name": null, "from_type": "Indicator", "id": "64f6e755-dd86-4f12-a067-bee4e3561743", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--c872a03b-1926-57e9-80e8-31c5b436c964", "toId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_name": "JITTERLY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.734Z", "created_at": "2026-09-26T07:08:40.054Z", "modified": "2026-09-26T07:08:40.243Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:40.243Z" }, "description_available": false, "entity_type": "targets", "fromId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_name": "JITTERLY", "from_type": "Malware", "id": "6591dd63-f71c-44d3-99b7-2ecea805eb5a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--470380b5-275b-581f-8692-cfebe345afac", "toId": "31b901d5-1e5f-4752-9173-f0144572ec05", "to_id": "31b901d5-1e5f-4752-9173-f0144572ec05", "to_name": "CVE-2026-60004", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.830Z", "created_at": "2026-09-26T07:11:27.538Z", "modified": "2026-09-26T07:11:28.089Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:11:28.089Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "from_id": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "from_name": null, "from_type": "Indicator", "id": "6a014f6e-e9ab-41f9-a289-711001e6dabe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--a281c74f-2c80-516c-8cc8-68977c0bf1b4", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.754Z", "created_at": "2026-09-26T07:08:56.031Z", "modified": "2026-09-26T07:08:56.387Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:56.387Z" }, "description_available": false, "entity_type": "based-on", "fromId": "df25fce2-21fb-4a13-be61-c48255d50cd8", "from_id": "df25fce2-21fb-4a13-be61-c48255d50cd8", "from_name": null, "from_type": "Indicator", "id": "6bee874f-f289-4b93-8fb3-c4d424bb5ea3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--6b7d226a-50d3-50e0-83c4-5eee0bb7de09", "toId": "96d09e40-4d30-488f-9c06-ad12b963a6db", "to_id": "96d09e40-4d30-488f-9c06-ad12b963a6db", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.724Z", "created_at": "2026-09-26T07:06:58.758Z", "modified": "2026-09-26T07:06:58.956Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:58.956Z" }, "description_available": false, "entity_type": "targets", "fromId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_name": "JITTERLY", "from_type": "Malware", "id": "6c9f601e-fdf9-4221-be1c-e30bddfc8c23", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--10aca6eb-e6e6-5b64-9d1b-d7a70d5d63f9", "toId": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_name": "Defense", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.759Z", "created_at": "2026-09-26T07:08:56.849Z", "modified": "2026-09-26T07:08:58.156Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:58.156Z" }, "description_available": false, "entity_type": "based-on", "fromId": "aa501976-e35e-4368-b846-c17c548b3213", "from_id": "aa501976-e35e-4368-b846-c17c548b3213", "from_name": null, "from_type": "Indicator", "id": "6e738570-c0c4-41fb-b19b-2e207f10c2f5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--6fbd202b-f596-531b-bd20-b768ddec2b1a", "toId": "d029cbbc-c0e8-4b75-9fa0-87f4b7470a16", "to_id": "d029cbbc-c0e8-4b75-9fa0-87f4b7470a16", "to_name": null, "to_type": "Url" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.817Z", "created_at": "2026-09-26T07:11:18.236Z", "modified": "2026-09-26T07:11:18.389Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:11:18.389Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aa501976-e35e-4368-b846-c17c548b3213", "from_id": "aa501976-e35e-4368-b846-c17c548b3213", "from_name": null, "from_type": "Indicator", "id": "6fcbd92d-06b0-4a1f-bcaf-78c619c79ad0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--14bd64a2-7c45-5066-b166-b5940a7102e9", "toId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_name": "SIXZUT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.726Z", "created_at": "2026-09-26T07:07:03.075Z", "modified": "2026-09-26T07:07:04.602Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:04.602Z" }, "description_available": false, "entity_type": "targets", "fromId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_name": "JITTERLY", "from_type": "Malware", "id": "717c629d-c563-463d-959c-4c3b31068a07", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--9cf6aa23-3834-599b-8ac0-bc1528a9f97b", "toId": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_id": "08257c10-e1ae-4471-bc3f-251792c1126c", "to_name": "Telecommunications", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.668Z", "created_at": "2026-09-26T07:07:19.997Z", "modified": "2026-09-26T07:07:20.211Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:20.211Z" }, "description_available": false, "entity_type": "uses", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "72bb5d72-3cb4-4f43-9b4a-4c5b0fe80c06", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--1985ed1c-729f-5402-8d6f-49144828e387", "toId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_name": "JITTERLY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.817Z", "created_at": "2026-09-26T07:11:11.395Z", "modified": "2026-09-26T07:11:11.716Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:11:11.716Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aa501976-e35e-4368-b846-c17c548b3213", "from_id": "aa501976-e35e-4368-b846-c17c548b3213", "from_name": null, "from_type": "Indicator", "id": "740f3227-f0da-4a7f-b466-6f5b4a58d708", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--f8897550-dc8b-52aa-aab4-289bb2d89dd8", "toId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_name": "JITTERLY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.779Z", "created_at": "2026-09-26T07:09:14.995Z", "modified": "2026-09-26T07:09:17.762Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:09:17.762Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f848995d-bb15-4202-807a-6747fa1f9ab6", "from_id": "f848995d-bb15-4202-807a-6747fa1f9ab6", "from_name": null, "from_type": "Indicator", "id": "7711d932-115b-4cbb-9dc2-bc73605ef1f8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--c648c470-6003-5088-88f4-06211e4b4224", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.792Z", "created_at": "2026-09-26T07:09:54.808Z", "modified": "2026-09-26T07:10:00.874Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:10:00.874Z" }, "description_available": false, "entity_type": "indicates", "fromId": "df25fce2-21fb-4a13-be61-c48255d50cd8", "from_id": "df25fce2-21fb-4a13-be61-c48255d50cd8", "from_name": null, "from_type": "Indicator", "id": "7b65402c-8e3d-4be7-af39-c5fe1409c1dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--b93b51b2-3e90-5d0c-bcae-00a20a13a59d", "toId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_name": "SIXZUT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.731Z", "created_at": "2026-09-26T07:07:12.275Z", "modified": "2026-09-26T07:07:12.577Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:12.577Z" }, "description_available": false, "entity_type": "targets", "fromId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_name": "SIXZUT", "from_type": "Malware", "id": "844ff9a1-0fc9-42ce-9dad-72def94d8ee3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--560d3a1b-2698-5b73-bbcc-b93a3325ea70", "toId": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_name": "Education", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.727Z", "created_at": "2026-09-26T07:07:08.200Z", "modified": "2026-09-26T07:07:08.417Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:08.417Z" }, "description_available": false, "entity_type": "targets", "fromId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_name": "JITTERLY", "from_type": "Malware", "id": "84623ad5-1a08-4e69-a300-0d9d9b0b86c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--5bf1b6d8-de4e-5681-9b50-b048e19cd363", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.863Z", "created_at": "2026-09-26T07:12:04.449Z", "modified": "2026-09-26T07:12:04.776Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:12:04.776Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d6631331-c2af-475c-bbfc-1dd19274a8cd", "from_id": "d6631331-c2af-475c-bbfc-1dd19274a8cd", "from_name": null, "from_type": "Indicator", "id": "886fedc8-18e9-429b-a08f-e6df31efb301", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--50851be3-9af4-50f8-ac20-476887ac9ccc", "toId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_name": "JITTERLY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.729Z", "created_at": "2026-09-26T07:07:20.049Z", "modified": "2026-09-26T07:07:20.576Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:20.576Z" }, "description_available": false, "entity_type": "targets", "fromId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "from_name": "SIXZUT", "from_type": "Malware", "id": "8aa55328-da5b-4e41-ac14-f474b3363093", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--0ae39243-d952-5f32-af92-7467e532d68a", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.756Z", "created_at": "2026-09-26T07:08:56.730Z", "modified": "2026-09-26T07:08:57.141Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:57.141Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9aa9e02a-6f46-458b-908a-db59f639a093", "from_id": "9aa9e02a-6f46-458b-908a-db59f639a093", "from_name": null, "from_type": "Indicator", "id": "8d2f5db1-8c02-43ca-b90c-d3f98dcfa200", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--c60ce36c-7a13-5e0f-884f-268ac9594e75", "toId": "c29133f5-d963-4a56-b0f6-cdf0383b87e9", "to_id": "c29133f5-d963-4a56-b0f6-cdf0383b87e9", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.768Z", "created_at": "2026-09-26T07:09:14.971Z", "modified": "2026-09-26T07:09:16.986Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:09:16.986Z" }, "description_available": false, "entity_type": "indicates", "fromId": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "from_id": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "from_name": null, "from_type": "Indicator", "id": "9d86563b-19d5-4a48-a545-dc7007d61ff7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--45eca0fa-7a57-5f37-bce3-29322d12543e", "toId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_name": "SIXZUT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.720Z", "created_at": "2026-09-26T07:06:54.274Z", "modified": "2026-09-26T07:06:54.514Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:54.514Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "9dd0ebe2-2b2f-4cab-b361-4046f974a63f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--e266486d-7987-56de-b3df-8065a18b2d4b", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.751Z", "created_at": "2026-09-26T07:08:55.804Z", "modified": "2026-09-26T07:08:56.120Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:56.120Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f848995d-bb15-4202-807a-6747fa1f9ab6", "from_id": "f848995d-bb15-4202-807a-6747fa1f9ab6", "from_name": null, "from_type": "Indicator", "id": "a1267856-0b6f-414e-9055-103a39d663f3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--6911b963-d6af-5ac1-bc93-124cf39042cb", "toId": "05c13330-545d-4049-8b45-b24c40697069", "to_id": "05c13330-545d-4049-8b45-b24c40697069", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.669Z", "created_at": "2026-09-26T07:07:35.323Z", "modified": "2026-09-26T07:07:35.530Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:35.530Z" }, "description_available": false, "entity_type": "uses", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "ae837d6d-7050-4240-8f99-e73e26ebfac6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--17adae1b-c9ca-5ebb-b91a-3922dcd19f2b", "toId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_name": "SIXZUT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.722Z", "created_at": "2026-09-26T07:06:57.662Z", "modified": "2026-09-26T07:06:58.024Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:58.024Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "aef015b0-3baf-4deb-95a3-9f242d956ba6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--41b75240-4459-5235-b12b-53549bc2ebcc", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.390Z", "created_at": "2026-01-18T14:35:22.125Z", "modified": "2026-01-18T14:35:22.364Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:35:22.364Z" }, "description_available": true, "entity_type": "part-of", "fromId": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "from_id": "b29cdd40-fcdf-493b-a3a8-bd61aba340ec", "from_name": "Air transport", "from_type": "Sector", "id": "b3434cc4-76d3-42c8-92a8-5514937dc9d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "part-of", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--01b463cc-7632-5741-8c0e-5d8a1a18a15b", "toId": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "to_id": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "to_name": "Transport", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.803Z", "created_at": "2026-09-26T07:10:55.892Z", "modified": "2026-09-26T07:10:56.069Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:10:56.069Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9aa9e02a-6f46-458b-908a-db59f639a093", "from_id": "9aa9e02a-6f46-458b-908a-db59f639a093", "from_name": null, "from_type": "Indicator", "id": "b5d31514-9981-4c99-8043-6ff1c879d0e9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--63bc660c-f327-5b90-a397-d22c859e6cda", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.728Z", "created_at": "2026-09-26T07:07:08.880Z", "modified": "2026-09-26T07:07:09.008Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:09.008Z" }, "description_available": false, "entity_type": "targets", "fromId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_name": "JITTERLY", "from_type": "Malware", "id": "bbef1c49-42db-42f7-b9bf-210df15f978a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--bfeb041c-eb7f-5763-b7a4-6723bc58d844", "toId": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_id": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_name": "Non-Governmental Organizations (NGOs)", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.749Z", "created_at": "2026-09-26T07:08:55.172Z", "modified": "2026-09-26T07:08:55.304Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:55.304Z" }, "description_available": false, "entity_type": "based-on", "fromId": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "from_id": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "from_name": null, "from_type": "Indicator", "id": "cc57cc21-d81d-4460-a337-11c68421e11b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--1dc56f09-2c82-576d-9d26-95a928d1429f", "toId": "0c0112f5-e12e-49cc-8f54-7220f52bd079", "to_id": "0c0112f5-e12e-49cc-8f54-7220f52bd079", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.723Z", "created_at": "2026-09-26T07:06:58.764Z", "modified": "2026-09-26T07:06:58.999Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:58.999Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "d7f8c966-cea0-45e1-a0b7-edeac73b8277", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--b1c1ee4f-1c00-5591-a05b-0a53a39c75a6", "toId": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_id": "26d0cb6b-e9e1-4ef7-8531-9156dcc6046b", "to_name": "Non-Governmental Organizations (NGOs)", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.734Z", "created_at": "2026-09-26T07:08:39.457Z", "modified": "2026-09-26T07:08:39.768Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:08:39.768Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "d9f2912e-5f96-488d-bed1-401f455e0748", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--d1574184-4db7-55d4-80f5-09df9f2f6576", "toId": "31b901d5-1e5f-4752-9173-f0144572ec05", "to_id": "31b901d5-1e5f-4752-9173-f0144572ec05", "to_name": "CVE-2026-60004", "to_type": "Vulnerability" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.719Z", "created_at": "2026-09-26T07:06:48.377Z", "modified": "2026-09-26T07:06:48.863Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:06:48.863Z" }, "description_available": false, "entity_type": "targets", "fromId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "from_name": "Red Heron", "from_type": "IntrusionSet", "id": "de168914-bbff-4016-a3a5-eb8f99c63ed3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--15c74d8f-7858-5249-916f-76205c03bc03", "toId": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_name": "Defense", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.804Z", "created_at": "2026-09-26T07:10:58.903Z", "modified": "2026-09-26T07:10:59.086Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:10:59.086Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9aa9e02a-6f46-458b-908a-db59f639a093", "from_id": "9aa9e02a-6f46-458b-908a-db59f639a093", "from_name": null, "from_type": "Indicator", "id": "dfa9fc57-c5cf-4191-a9e6-399d235129ac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--a89697d3-f566-5f53-860a-0599a1af695b", "toId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_name": "SIXZUT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.816Z", "created_at": "2026-09-26T07:11:10.778Z", "modified": "2026-09-26T07:11:11.024Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:11:11.024Z" }, "description_available": false, "entity_type": "indicates", "fromId": "aa501976-e35e-4368-b846-c17c548b3213", "from_id": "aa501976-e35e-4368-b846-c17c548b3213", "from_name": null, "from_type": "Indicator", "id": "e616d8e6-6089-4f29-8358-aa5843282ad4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--f1842f9f-d733-5b94-a31c-63c80f9976c9", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.831Z", "created_at": "2026-09-26T07:11:28.931Z", "modified": "2026-09-26T07:11:29.193Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:11:29.193Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "from_id": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "from_name": null, "from_type": "Indicator", "id": "e77db9ba-374b-4fea-b390-7c983ee908bc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--6e66bd75-d616-5866-9194-31f7c6d6bf88", "toId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_name": "JITTERLY", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.863Z", "created_at": "2026-09-26T07:12:13.810Z", "modified": "2026-09-26T07:12:14.008Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:12:14.008Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d6631331-c2af-475c-bbfc-1dd19274a8cd", "from_id": "d6631331-c2af-475c-bbfc-1dd19274a8cd", "from_name": null, "from_type": "Indicator", "id": "e7b5fdcf-418b-47f2-9d27-dd6c6138c7d2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--3aad5a1b-f784-52fb-b1cd-3f33e34ab95c", "toId": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "to_name": "SIXZUT", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.727Z", "created_at": "2026-09-26T07:07:11.049Z", "modified": "2026-09-26T07:07:11.535Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:07:11.535Z" }, "description_available": false, "entity_type": "targets", "fromId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "from_name": "JITTERLY", "from_type": "Malware", "id": "e9af973d-f7cb-422e-9565-1858e769df3d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--a2593cd5-b281-5cff-979a-595353c5387c", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.862Z", "created_at": "2026-09-26T07:12:03.980Z", "modified": "2026-09-26T07:12:04.182Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:12:04.182Z" }, "description_available": false, "entity_type": "indicates", "fromId": "d6631331-c2af-475c-bbfc-1dd19274a8cd", "from_id": "d6631331-c2af-475c-bbfc-1dd19274a8cd", "from_name": null, "from_type": "Indicator", "id": "f6cd5b1c-2ce8-42c5-ad63-a48b879ea904", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--b80692af-9843-5009-8f21-a6f5f4f48f7b", "toId": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_id": "b606a6af-c0bb-409d-b0e5-112553d063c1", "to_name": "Red Heron", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:55:52.803Z", "created_at": "2026-09-26T07:10:56.550Z", "modified": "2026-09-26T07:10:57.928Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T07:10:57.928Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9aa9e02a-6f46-458b-908a-db59f639a093", "from_id": "9aa9e02a-6f46-458b-908a-db59f639a093", "from_name": null, "from_type": "Indicator", "id": "f7408def-a498-440a-a785-d54f811e8e08", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "standard_id": "relationship--0b442d29-4df3-5285-81be-33cbbedde40d", "toId": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "to_name": "JITTERLY", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "xcyoibfhuufz[.]com", "description_available": false, "object_id": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "object_ids": [ "9912b23a-2e30-4c66-a347-babccb5ac377", "d5b8d61f-85af-4c21-a889-65e5f8f20a57" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "d5b8d61f-85af-4c21-a889-65e5f8f20a57", "valid_from": "2026-09-15T13:05:51.000Z", "valid_until": "2026-12-27T04:00:59.260Z", "validity_status": "active", "value": "xcyoibfhuufz.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "9912b23a-2e30-4c66-a347-babccb5ac377", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "xcyoibfhuufz.com" } ], "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "type": "domain", "valid_from": "2026-09-15T13:05:51.000Z", "valid_until": "2026-12-27T04:00:59.260Z", "validity_status": "active", "value": "xcyoibfhuufz.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3a1e96289832518bff2feeb868bc61a4", "description_available": false, "object_id": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "object_ids": [ "0c0112f5-e12e-49cc-8f54-7220f52bd079", "294e3c5a-4dea-4231-af04-42a5292d3bd0" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "294e3c5a-4dea-4231-af04-42a5292d3bd0", "valid_from": "2026-09-15T13:05:51.000Z", "valid_until": "2027-07-03T00:15:35.557Z", "validity_status": "active", "value": "3a1e96289832518bff2feeb868bc61a4" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "0c0112f5-e12e-49cc-8f54-7220f52bd079", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3a1e96289832518bff2feeb868bc61a4" } ], "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "type": "md5", "valid_from": "2026-09-15T13:05:51.000Z", "valid_until": "2027-07-03T00:15:35.557Z", "validity_status": "active", "value": "3a1e96289832518bff2feeb868bc61a4" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "88264a49750b3280e63894fb7445a9c2", "description_available": false, "object_id": "f848995d-bb15-4202-807a-6747fa1f9ab6", "object_ids": [ "05c13330-545d-4049-8b45-b24c40697069", "f848995d-bb15-4202-807a-6747fa1f9ab6" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f848995d-bb15-4202-807a-6747fa1f9ab6", "valid_from": "2026-09-15T13:05:51.000Z", "valid_until": "2027-07-03T00:15:35.557Z", "validity_status": "active", "value": "88264a49750b3280e63894fb7445a9c2" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "05c13330-545d-4049-8b45-b24c40697069", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "88264a49750b3280e63894fb7445a9c2" } ], "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "type": "md5", "valid_from": "2026-09-15T13:05:51.000Z", "valid_until": "2027-07-03T00:15:35.557Z", "validity_status": "active", "value": "88264a49750b3280e63894fb7445a9c2" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "28b132ad55bd310bb5cf3ddb4ace580529ad735204a48cf388830d9039843d8e", "description_available": false, "object_id": "df25fce2-21fb-4a13-be61-c48255d50cd8", "object_ids": [ "96d09e40-4d30-488f-9c06-ad12b963a6db", "df25fce2-21fb-4a13-be61-c48255d50cd8" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "df25fce2-21fb-4a13-be61-c48255d50cd8", "valid_from": "2026-09-15T13:05:51.000Z", "valid_until": "2027-07-03T00:15:35.557Z", "validity_status": "active", "value": "28b132ad55bd310bb5cf3ddb4ace580529ad735204a48cf388830d9039843d8e" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "96d09e40-4d30-488f-9c06-ad12b963a6db", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "28b132ad55bd310bb5cf3ddb4ace580529ad735204a48cf388830d9039843d8e" } ], "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "type": "sha256", "valid_from": "2026-09-15T13:05:51.000Z", "valid_until": "2027-07-03T00:15:35.557Z", "validity_status": "active", "value": "28b132ad55bd310bb5cf3ddb4ace580529ad735204a48cf388830d9039843d8e" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b441f793c87e54cb7e3f7205e25442aa19920d325cb6af41d2afdc8a0b5cf54f", "description_available": false, "object_id": "9aa9e02a-6f46-458b-908a-db59f639a093", "object_ids": [ "9aa9e02a-6f46-458b-908a-db59f639a093", "c29133f5-d963-4a56-b0f6-cdf0383b87e9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9aa9e02a-6f46-458b-908a-db59f639a093", "valid_from": "2026-09-15T13:05:51.000Z", "valid_until": "2027-07-03T00:15:35.557Z", "validity_status": "active", "value": "b441f793c87e54cb7e3f7205e25442aa19920d325cb6af41d2afdc8a0b5cf54f" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c29133f5-d963-4a56-b0f6-cdf0383b87e9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b441f793c87e54cb7e3f7205e25442aa19920d325cb6af41d2afdc8a0b5cf54f" } ], "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/", "type": "sha256", "valid_from": "2026-09-15T13:05:51.000Z", "valid_until": "2027-07-03T00:15:35.557Z", "validity_status": "active", "value": "b441f793c87e54cb7e3f7205e25442aa19920d325cb6af41d2afdc8a0b5cf54f" } ], "mentioned": [ { "confidence": 50, "evidence_id": "09a16c96-ab21-4f0f-99ff-2dbe31c43934", "name": "JITTERLY", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "6ffb071f-2c32-47d2-a4ed-3e6ff680222e", "name": "SIXZUT", "role": "mentionné", "type": "Malware" }, { "confidence": 100, "evidence_id": "b9a0dfa4-df11-4fbb-b4ac-04f7e6d5c481", "name": "Civil society", "role": "mentionné", "type": "Sector" }, { "confidence": 100, "evidence_id": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "name": "Transport", "role": "mentionné", "type": "Sector" }, { "confidence": 80, "evidence_id": "31b901d5-1e5f-4752-9173-f0144572ec05", "name": "CVE-2026-60004", "role": "mentionné", "type": "Vulnerability" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-15T13:05:50.968Z", "created_at": "2026-09-26T07:12:23.964Z", "modified": "2026-09-26T07:12:38.801Z", "published": "2026-09-15T13:05:50.968Z", "updated_at": "2026-09-26T07:12:38.801Z" }, "description_available": true, "id": "e66a481f-ccdc-49a8-92d5-adb76e7ee773", "is_inferred": false, "labels": [ "cve-2026-60004", "elections targeting", "gitea", "jitterly", "rootkit", "sixzut" ], "lang": "en", "name": "Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-15T13:05:50.968Z", "references": [ { "external_id": "6aa942aeb8beed53be78ec12", "id": "a1bb8616-1161-4e64-93ad-6e5afebdc707", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aa942aeb8beed53be78ec12" }, { "external_id": null, "id": "54772bee-5d14-4f87-8776-0da6ddbdfad0", "source_name": "malpedia", "url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/" }, "targets": [ { "confidence": 50, "evidence_id": "2ec90f23-8cc6-40af-89e1-34c270b68fe4", "name": "Air transport", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "de168914-bbff-4016-a3a5-eb8f99c63ed3", "name": "Defense", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "844ff9a1-0fc9-42ce-9dad-72def94d8ee3", "name": "Education", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "3fa09c29-3c42-44ed-b644-9d17a23dc8f7", "name": "Energy", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "e9af973d-f7cb-422e-9565-1858e769df3d", "name": "Finance", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "9dd0ebe2-2b2f-4cab-b361-4046f974a63f", "name": "Government and administrations", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "d7f8c966-cea0-45e1-a0b7-edeac73b8277", "name": "Non-Governmental Organizations (NGOs)", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "84623ad5-1a08-4e69-a300-0d9d9b0b86c8", "name": "Technologies", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "717c629d-c563-463d-959c-4c3b31068a07", "name": "Telecommunications", "role": "cible déclarée (relation targets)", "type": "Sector" } ], "techniques": [], "vulnerabilities": [ "CVE-2026-60004" ] }, "report_id": "e66a481f-ccdc-49a8-92d5-adb76e7ee773", "schema_version": 1, "selected_date": "2026-09-15", "source_url": "https://www.acronis.com/en/tru/posts/red-heron-exploits-gitea-n-day-flaw-in-multinational-campaign-exposing-new-linux-rootkit/" }