Red Heron Exploits Gitea Flaw to Breach Global Infrastructure

Key Takeaways

• Red Heron scanned 1,386 Gitea instances across seven countries and compromised 13 systems in six countries.
• CVE-2026-60004 gave the threat actor an entry point for source-code theft, credential collection, persistence, and lateral movement.
• Researchers linked the campaign to JITTERLY and SIXZUT, a Linux implant and rootkit designed for durable, concealed access.

A Chinese-speaking threat actor tracked as Red Heron rapidly turned a newly disclosed Gitea vulnerability into a multinational intrusion campaign, according to research published by Acronis Threat Research Unit. The operation reached beyond repository theft, giving Red Heron access to credentials, application secrets, internal networks and, in one case, a three-node Proxmox cluster.

The campaign illustrates why self-hosted development systems deserve the same scrutiny as identity platforms and internet-facing business applications. Gitea repositories can contain far more than source code. Configuration files, deployment keys, infrastructure definitions and embedded tokens can turn one compromised server into a map of the wider environment.

Red Heron scanned 1,386 Gitea instances across seven countries. Acronis TRU found evidence of 13 compromises spanning Canada, Argentina, Taiwan, the United States, Qatar and Sri Lanka. The targeting data covered energy, aerospace, telecommunications, government, public safety, research, elections and industrial automation.

That sector mix raises the stakes. ENISA NIS360 treats energy, telecommunications and other high-criticality industries as priority sectors under NIS2. A breach of a development server in these environments may expose intellectual property, but it can also reveal how operational systems are configured and connected.

At the center of the campaign was CVE-2026-60004, a critical remote code execution vulnerability with a CVSS score of 9.8. It affects Gitea versions 1.17 through 1.27.0. Gitea patched the issue in version 1.27.1 on July 27, 2026, and published its technical advisory the next day.

Red Heron began modifying public proof-of-concept code on July 29. By July 30, the actor had scanned the 1,386 instances using automated probes. By early August, its framework could register accounts, exploit vulnerable servers, copy repositories and attempt to remove selected traces.

Open registration made some deployments particularly exposed. The vulnerable diffpatch route required repository write access, but an attacker could obtain that access by creating an account on a Gitea instance where public signup remained enabled. Open registration was not the underlying vulnerability, though it reduced the access barrier.

The evidence moved the issue beyond theoretical severity. CISA reporting on CVE-2026-60004 classified it as a known exploited vulnerability after adding it to the Known Exploited Vulnerabilities catalog on August 25, 2026.

Repository theft was only the opening phase of the attack. In a Canadian renewable-energy environment, Red Heron conducted 22 exploitation sessions and obtained application code for HR, CRM, authentication, intranet and reporting systems. The actor collected JWT tokens, internal credentials, SSH host keys and a deployment key, then added SSH persistence and mapped the internal Docker environment.

The deepest intrusion began with a vulnerable Gitea server on a Synology NAS in Taiwan. Red Heron subsequently obtained a Proxmox root authentication ticket, uploaded payloads to three nodes and initiated virtual-machine backups with vzdump. If completed, those backups could provide full VM disk images rather than isolated repositories.

The research team gained unusual visibility because Red Heron left its staging server exposed without authentication. The server contained command histories, reconnaissance databases, stolen repositories and malware. Those artifacts connected the campaign to JITTERLY, a C++ Linux implant supporting more than 30 post-exploitation commands, including file transfer, shell execution, tunneling, interactive terminal access and internal pivoting.

Embedded inside JITTERLY was SIXZUT, a previously undocumented LD_PRELOAD rootkit. SIXZUT can conceal files, processes and network connections, interfere with attempts to terminate the implant and relaunch it under certain conditions. That persistence changes incident response calculations because normal live-system tools may show a manipulated view of the host.

Gitea operators should upgrade to version 1.27.1 or later, disable unnecessary public registration and review exposure of the diffpatch route. Security teams should also inspect account creation, repository activity, Gitea child processes, unusual metrics API requests, authorized SSH keys and changes to /etc/ld.so.preload. Where SIXZUT is suspected, offline analysis or trusted endpoint telemetry is preferable to relying solely on commands executed on the affected server. Confirmed compromise may justify rebuilding the host and rotating every credential, token and key accessible through Gitea.