Red Heron APT Exploits Gitea RCE to Hit 13 Organizations Globally

A suspected China-linked threat actor tracked as Red Heron has been blamed for a sweeping cyber-espionage campaign that weaponized a critical remote code execution flaw in Gitea, the open-source self-hosted code collaboration platform, to compromise at least 13 organizations across six countries. According to Acronis Threat Research Unit, the actor scanned 1,386 Gitea instances across seven nations and maintained a separate dataset of 477 Taiwan-based systems, ultimately achieving root-level access to a three-node Proxmox cluster in one Taiwanese environment. Confirmed victims span Canada (2), Argentina (1), Taiwan (4), the U.S. (4), Qatar (1), and Sri Lanka (1), with targets classified using Simplified Chinese labels across defense, election, energy, aerospace, telecommunications, government, public safety, and research sectors. Analysts assess with moderate confidence that Red Heron operates within a Chinese intelligence context, citing linguistic artifacts, the consistent treatment of Taiwan as part of China, and a targeting footprint aligned with Beijing's strategic collection priorities.

The intrusions began on July 29, 2026, just days after public disclosure of CVE-2026-60004, when Red Heron converted an available proof-of-concept exploit into a fully automated Python framework dubbed "exp_enhanced.py" capable of registering accounts, exploiting vulnerable servers, exfiltrating repositories, and selectively scrubbing forensic traces. Forensic analysis of a Red Heron staging server uncovered two novel implants: JITTERLY, a C++ Linux backdoor supporting more than 30 post-exploitation commands covering shell execution, file transfer, process termination, network tunneling, interactive terminal access, and internal pivoting; and SIXZUT, a previously undocumented LD_PRELOAD rootkit that patches 15 distinct Linux functions to hide files, processes, and network connections, while also auto-relaunching the backdoor if it is terminated or removed. JITTERLY was first publicly documented in July 2026 by the researcher "dmpdump," who noted code-level overlaps with the AdaptixC2 agent.

The campaign's kill chain progressed from initial source-code theft to persistent foothold establishment, credential harvesting, and lateral movement into adjacent infrastructure, demonstrating how quickly N-day vulnerabilities in internet-exposed development platforms can cascade into broader enterprise compromise. For organizations running self-hosted Git platforms, defenders should immediately audit exposure by running a port scanner against any publicly reachable Gitea instance, confirm patching status against CVE-2026-60004, and review authentication logs for unauthorized account registrations. Security teams should also use a WHOIS lookup to inventory all internet-facing development assets tied to their organization and validate that TLS configurations pass a SSL/TLS checker review, as Red Heron's playbook specifically favored misconfigured, internet-reachable instances without hardened transport security.