Red Heron: JITTERLY Linux Backdoor Execution and C2 Beaconing

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•1

Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.