Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
Red Heron exploits Gitea RCE vulnerability to compromise 13 organizations across six countries.
A suspected Chinese threat actor, Red Heron, has rapidly exploited a critical Gitea remote code execution vulnerability (CVE-2026-60004) to compromise 13 organizations across six countries. The campaign, which began shortly after the vulnerability's disclosure, involved scanning thousands of Gitea instances and progressed from source-code theft to persistent access, credential collection, and lateral movement, including root-level access to Proxmox clusters. The actor deployed a C++ Linux implant named JITTERLY and a rootkit called SIXZUT to hide their activities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Gitea?
Get an email when a new story names Gitea, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Red Heron campaign demonstrates how nation-state actors rapidly weaponize newly disclosed vulnerabilities — in this case, a critical Gitea RCE (CVE-2026-60004) — to achieve broad compromise before organizations can apply patches. The attackers moved swiftly from initial exploitation to source-code theft, credential harvesting, lateral movement, and root-level cluster access, illustrating the cascading damage possible when a single unpatched internet-facing service is exposed. The deployment of a custom Linux implant (JITTERLY) and rootkit (SIXZUT) further highlights how delayed patching grants adversaries time to establish deep, persistent footholds that are difficult to eradicate. Organizations hosting development infrastructure like Gitea publicly must treat critical CVEs as emergency events requiring immediate remediation, not routine patch cycles.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-60004
- malware — JITTERLY
- malware — SIXZUT