#ParsedReport #CompletenessMedium
26-09-2026

Tracing SIXZUT and JITTERLY in the wild

https://www.virlabs.ai/blog/red-heron/

Report completeness: Medium

Actors/Campaigns:
Red_heron

Threats:
Sixzut
Jitterly
Adaptixc2_tool

Victims:
Gitea servers, Hestiacp servers, Unifi devices, Industrial automation, Government

Industry:
Government, Ics

ChatGPT TTPs:
do not use without manual check
T1005, T1014, T1027.013, T1057, T1071, T1190, T1564, T1573, T1574.006

IOCs:
Hash: 8
Domain: 6
IP: 4
Url: 0
Email: 0
BrowserExtension: 0

Soft:
Linux, nginx

Algorithms:
aes-128-ctr, sha1, sha256, aes-128-gcm, crc-32, aes-gcm

Functions:
kill