Red Heron Breaches 13 Organizations Through a Gitea Vulnerability

Researchers at the Acronis Threat Research Unit (TRU) have detailed a campaign by a group tracked as Red Heron. In the team's assessment, it operates in China's interests — pointing to this are the Simplified Chinese labels used to classify targets, the consistent treatment of Taiwan as PRC territory, and the overlap between the target list and the priorities of Chinese intelligence.

From Public PoC to Automated Pipeline

Gitea is a self-hosted code-hosting platform, an analog of GitHub that many companies deploy on-premises. The starting point was the critical remote code execution vulnerability CVE-2026-60004. Within just a few days of its disclosure in July 2026, the attackers turned the published proof-of-concept into a full-fledged Python framework (exp_enhanced.py) capable of registering accounts, exploiting vulnerable servers, stealing repositories and covering select tracks. Automated scanning began on July 29.

In all, Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate list of 477 systems in Taiwan. Confirmed breaches affected organizations in Canada (2), Argentina (1), Taiwan (4), the United States (4), Qatar (1) and Sri Lanka (1). The sectors involved include defense, electoral systems, energy, aerospace, telecom, the public sector, public safety and research.

Toolkit

On the server used to stage the attacks, researchers found a C++ implant for Linux named JITTERLY, supporting more than 30 post-exploitation commands: launching a shell, transferring files, tunneling traffic, interactive terminal access and lateral movement within a network. Its overlaps with the AdaptixC2 agent had earlier been noted by a researcher going by the handle dmpdump.

Bundled with the backdoor was a previously undocumented LD_PRELOAD-based rootkit called SIXZUT. It hides files, processes and network connections by patching 15 different Linux functions, hampers detection and removal of the malware, and relaunches itself when someone attempts to delete it.

Depth of the Intrusion

The campaign did not stop at stealing source code. In one Taiwanese environment, the attackers went from a vulnerable Gitea server to root access on all three nodes of a Proxmox cluster. From a Taiwanese industrial-automation company, hundreds of repositories were stolen relating to a SCADA/HMI tool, IoT integrations, a network sniffer and video-surveillance systems. From a Canadian renewable-energy company, the attackers took configuration secrets, internal tokens and host SSH keys.

The same infrastructure was used to attack 18 Joomla sites across ten countries. As researcher Subhajit Sinha notes, the episode shows how quickly N-day vulnerabilities in self-hosted development platforms can open the door to source code, credentials and the associated infrastructure.

Source: The Hacker News