Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

Summary

A suspected Chinese threat actor, Red Heron, has rapidly exploited a critical Gitea remote code execution vulnerability (CVE-2026-60004) to compromise 13 organizations across six countries. The campaign, which began shortly after the vulnerability's disclosure, involved scanning thousands of Gitea instances and progressed from source-code theft to persistent access, credential collection, and lateral movement, including root-level access to Proxmox clusters. The actor deployed a C++ Linux implant named JITTERLY and a rootkit called SIXZUT to hide their activities.

Full text

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries Ravie LakshmananSep 14, 2026Cyber Espionage / Vulnerability A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. "Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems," Acronis Threat Research Unit (TRU) said in an analysis. "The activity progressed from source-code theft to persistent access, credential collection, and lateral movement, including root-level access to a three-node Proxmox cluster." The activity is said to have resulted in confirmed compromises affected organizations in Canada (2), Argentina (1), Taiwan (4), the U.S. (4), Qatar (1), and Sri Lanka (1), with the threat actor using Simplified Chinese labels to classify targets spanning defense, election, energy, aerospace, telecommunications, government, public safety, and research sectors. The Singapore cybersecurity company has assessed Red Heron to be operating within a China-linked context with moderate confidence owing to the presence of Simplified Chinese, the cluster's consistent classification of Taiwan as part of China, and targeting footprint that aligns with China's intelligence collection priorities. An analysis of a staging server attributed to the adversary has uncovered a C++ Linux implant dubbed JITTERLY, which supports more than 30 post-exploitation commands related to shell execution, file transfer, process termination, network tunneling, interactive terminal access, and internal pivoting. JITTERLY was previously documented by a researcher who goes by the online alias "dmpdump" in July 2026, describing it as sharing overlaps with the AdaptixC2 agent. Present within the backdoor is a previously undocumented LD_PRELOAD rootkit called SIXZUT that's capable of hiding files, processes, and network connections by patching 15 different Linux functions to cover up traces of malicious activity and prevent the malware from being detected and killed, as well as relaunching if it gets terminated or removed. Red Heron has been observed weaponizing CVE-2026-60004, a critical Gitea remote code execution vulnerability, to scan thousands of instances across seven countries, turning a publicly-available exploit for the flaw into a full-fledged automated Python framework ("exp_enhanced.py") starting July 29, 2026. "Within days of the vulnerability's July 2026 disclosure, Red Heron transformed public proof-of-concept code into an automated framework capable of registering accounts, exploiting vulnerable servers, stealing repositories, and removing selected traces," security researcher Subhajeet Singha said. "The campaign demonstrates how quickly N-day vulnerabilities in self-hosted development platforms can expose source code, credentials, secrets, and connected infrastructure." In one Taiwanese environment, the threat actor has been observed progressing from a vulnerable Gitea server to root-level administrative access across a three-node Proxmox cluster. Further examination of the staging server has shed light on the attacker tradercraft - Using the same infrastructure to target 18 Joomla-based websites across 10 countries using a Python script ("exp.py") before cloning the CVE-2026-60004 exploit. Among those targets are an overseas education consulting firm based out of India and a U.S.-based IT managed service provider. Carrying extensive enumeration of an Argentine quantitative trading firm. Exfiltrating data from a Taiwanese industrial automation company, including hundreds of repositories related to a SCADA/HMI tool, IoT platform integrations, a network sniffer, server configurations, a surveillance and monitoring product, and internal business applications. Exfiltrating data from a Qatar-based target, including a learning management platform, an artificial intelligence (AI) chatbot, workflow automation tools, and WordPress plugins. Conducting extensive infrastructure mapping of a Canadian renewable energy company, exfiltrating repositories, configuration secrets, internal tokens, SSH host keys, and internal applications. "By combining automated Gitea exploitation with structured target selection, the actor progressed from repository theft to credential collection, persistent access, and lateral movement across victim environments," Singha said. "Its focus on organizations associated with elections, defense, energy, government, and research suggests deliberate collection priorities alongside broader opportunistic scanning." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  cyber espionage, linux, Malware, Vulnerability, Web Security ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Critical Vulnerabilities Might Not Be Your Biggest Risk What It Took to Reach 1 Billion Build Manifests US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries Why Are So Many Security Professionals Keeping Breaches Quiet? The Economics of Dwell Time and Why AI Native SIEM Changes the Equation ⭐ Featured Resources Get the eBook: Map Enterprise AI Risk Across the Full Lifecycle Give SOC Analysts Visibility Into 90% of Attacks Within 60 Seconds Benchmark Your SOC's AI Adoption With the 2026 Security Operations Report Register for LDR516: Strategic Vulnerability and Threat Management at SANS DC Metro

Indicators of Compromise

• cve — CVE-2026-60004
• malware — JITTERLY
• malware — SIXZUT

Entities