Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign.

"Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems," Acronis Threat Research Unit (TRU) said in an analysis.

"The activity progressed from source-code theft to persistent access, credential collection, and lateral movement, including root-level access to a three-node Proxmox cluster." The activity is said to have resulted in confirmed compromises affected organizations in Canada (2), Argentina (1), Taiwan (4), the U. S.

(4), Qatar (1), and Sri Lanka (1), with the threat actor using Simplified Chinese labels to classify targets spanning defense, election, energy, aerospace, telecommunications, government, public safety, and research sectors.

The Singapore cybersecurity company has assessed Red Heron to be operating within a China-linked context with moderate confidence owing to the presence of Simplified Chinese, the cluster's consistent classification of Taiwan as part of China, and targeting footprint that aligns with China's intelligence collection priorities.

Present within the backdoor is a previously undocumented LD_PRELOAD rootkit called SIXZUT that's capable of hiding files, processes, and network connections by patching 15 different Linux functions to cover up traces of malicious activity and prevent the malware from being detected and killed, as well as relaunching if it gets terminated or removed.

Red Heron has been observed weaponizing CVE-2026-60004 , a critical Gitea remote code execution vulnerability, to scan thousands of instances across seven countries, turning a publicly-available exploit for the flaw into a full-fledged automated Python framework ("exp_enhanced. py") starting July 29, 2026.

"Within days of the vulnerability's July 2026 disclosure, Red Heron transformed public proof-of-concept code into an automated framework capable of registering accounts, exploiting vulnerable servers, stealing repositories, and removing selected traces," security researcher Subhajeet Singha said.

"The campaign demonstrates how quickly N-day vulnerabilities in self-hosted development platforms can expose source code, credentials, secrets, and connected infrastructure." Singha told The Hacker News there is no evidence indicating the use of artificial intelligence (AI) to develop the exploitation framework.

"The operator appears to have adapted publicly available proof-of-concept code and other open-source tools," Singha added. In one Taiwanese environment, the threat actor has been observed progressing from a vulnerable Gitea server to root-level administrative access across a three-node Proxmox cluster.

Further examination of the staging server has shed light on the attacker tradercraft - The researcher also noted that JITTERLY was deployed in the confirmed compromises, but refrained from sharing details about the specific targets on which the implant was deployed due to ongoing investigation and to protect the affected organizations.

"By combining automated Gitea exploitation with structured target selection, the actor progressed from repository theft to credential collection, persistent access, and lateral movement across victim environments," Singha said.

"Its focus on organizations associated with elections, defense, energy, government, and research suggests deliberate collection priorities alongside broader opportunistic scanning." (The story was updated after publication to include additional insights from Acronis.)

See how to test new CVEs against your environment, confirm what attackers can actually exploit, and fix the exposures that pose the greatest risk. Learn how to identify exploitable risk faster, prioritize what matters most, and reduce exposure before AI-powered attacks accelerate the threat.