Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

A Chinese threat actor, identified as Red Heron, has been actively exploiting a critical remote code execution (RCE) vulnerability in Gitea to compromise internet-facing instances. The campaign began shortly after the vulnerability, CVE-2026-60004, was publicly disclosed on July 2026. Red Heron scanned 1,386 Gitea instances across seven countries, including Canada (2), Argentina (1), Taiwan (4), the U.S. (4), Qatar (1), and Sri Lanka (1).

Within days of the disclosure, the threat actor transformed public proof-of-concept code into an automated Python framework, "exp_enhanced.py," capable of registering accounts, exploiting vulnerable servers, stealing repositories, and removing selected traces. The campaign demonstrates how quickly N-day vulnerabilities in self-hosted development platforms can expose source code, credentials, secrets, and connected infrastructure.

In one Taiwanese environment, the threat actor progressed from a vulnerable Gitea server to root-level administrative access across a three-node Proxmox cluster. Further examination of a staging server revealed a C++ Linux implant dubbed JITTERLY, which supports more than 30 post-exploitation commands related to shell execution, file transfer, process termination, network tunneling, interactive terminal access, and internal pivoting. JITTERLY was previously documented by a researcher who goes by the online alias "dmpdump" in July 2026, describing it as sharing overlaps with the AdaptixC2 agent.

Present within the backdoor is a previously undocumented LD_PRELOAD rootkit called SIXZUT that’s capable of hiding files, processes, and network connections by patching 15 different Linux functions to cover up traces of malicious activity and prevent the malware from being detected and killed, as well as relaunching if it gets terminated or removed.

Red Heron has been observed weaponizing CVE-2026-60004 to scan thousands of instances across seven countries, turning a publicly-available exploit for the flaw into a full-fledged automated Python framework. The campaign demonstrates a structured approach to target selection and progression, moving from repository theft to credential collection, persistent access, and lateral movement across victim environments. The actor’s focus on organizations associated with elections, defense, energy, government, and research suggests deliberate collection priorities alongside broader opportunistic scanning.

Additional targeting activities included:

• Using the same infrastructure to target 18 Joomla-based websites across 10 countries using a Python script ("exp.py") before cloning the CVE-2026-60004 exploit. Among those targets are an overseas education consulting firm based out of India and a U.S.-based IT managed service provider.
• Carrying extensive enumeration of an Argentine quantitative trading firm.
• Exfiltrating data from a Taiwanese industrial automation company, including hundreds of repositories related to a SCADA/HMI tool, IoT platform integrations, a network sniffer, server configurations, a surveillance and monitoring product, and internal business applications.
• Exfiltrating data from a Qatar-based target, including a learning management platform, an artificial intelligence (AI) chatbot, workflow automation tools, and WordPress plugins.
• Conducting extensive infrastructure mapping of a Canadian renewable energy company, exfiltrating repositories, configuration secrets, internal tokens, SSH host keys, and internal applications.