Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

China-Linked Actor Turns a Gitea RCE Into a Global Espionage Campaign

A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid, automated exploitation of a critical remote code execution flaw in Gitea, the self-hosted Git service, compromising internet-facing instances as part of a multi-national campaign. According to research published by the Acronis Threat Research Unit (TRU), Red Heron scanned 1,386 Gitea instances across seven countries and confirmed breaches at 13 organizations across six countries — turning a public proof-of-concept into a working exploitation framework within days of the underlying vulnerability's disclosure.

Incident Summary

What Happened

The campaign centers on CVE-2026-60004, a critical remote code execution vulnerability (CVSS 9.8) in Gitea's diffpatch functionality, affecting self-hosted Gitea versions 1.17 through 1.27.0. Per Gitea's own advisory, the flaw lets an attacker with ordinary repository write access submit patch content that gets materialized as a Git hook and executed as the Gitea OS user — and because Gitea ships with open registration enabled by default, an unauthenticated visitor can obtain that write access simply by registering an account and creating a repository. The endpoint involved is /api/v1/repos/{owner}/{repo}/diffpatch.

Gitea shipped a fix in version 1.27.1, released July 27, 2026. Within days, Red Heron had converted a public proof-of-concept into exp_enhanced.py, an automated Python framework capable of registering accounts, exploiting vulnerable servers, stealing repository contents, and cleaning up selected traces of the intrusion. Acronis TRU says active exploitation by the group began July 29, 2026 — barely 48 hours after the patched release shipped.

The scanning effort was extensive: Red Heron probed 1,386 internet-facing Gitea instances across seven countries, and separately maintained a focused dataset of 477 Taiwan-based systems. Of the targets actually compromised, Acronis counted 13 organizations spread across Taiwan (4), the United States (4), Canada (2), Argentina (1), Qatar (1), and Sri Lanka (1).

Post-Exploitation Toolkit

Once inside, Red Heron deployed:

• JITTERLY — a C++ Linux implant supporting more than 30 post-exploitation commands, including shell execution, file transfer, network tunneling, and internal pivoting.
• SIXZUT — an LD_PRELOAD rootkit used to hide malicious files, processes, and network connections from the compromised host.

Notable Incidents

• In one Taiwanese environment, the actor progressed from initial Gitea access to root-level administrative control of a three-node Proxmox cluster.
• A Taiwanese industrial automation company had hundreds of repositories exfiltrated, including a SCADA/HMI tool, IoT platform integrations, a network sniffer, and server configuration data.
• Targets also included an overseas education consulting firm based in India and a U.S.-based IT managed service provider.
• In Argentina, the actor conducted extensive enumeration of a quantitative trading firm.
• Acronis noted the group reused infrastructure to previously target 18 Joomla-based websites across 10 countries with a separate script (exp.py), before pivoting to the Gitea exploit.

Attribution

Acronis TRU assessed with moderate confidence that Red Heron operates within a China-linked context. The basis for that call includes the group's consistent use of Simplified Chinese in its tooling and labels, its classification of Taiwan as part of China within its own operational datasets, and a targeting footprint — defense, elections, energy, aerospace, telecommunications, government, public safety, and research — that aligns with known Chinese intelligence-collection priorities. Acronis stopped short of naming a specific state sponsor or linking Red Heron to a previously catalogued APT group.

Separately, CISA confirmed active exploitation of CVE-2026-60004 more broadly on August 25, 2026, and at least one other publicly reported attack against a vulnerable Gitea server resulted in a cryptocurrency-mining dropper rather than espionage tooling. Neither CISA nor those other reports have attributed that broader opportunistic activity to Red Heron, suggesting multiple, unrelated actors are exploiting the same flaw for different objectives.

Why This Matters

This campaign is a sharp reminder of how quickly a disclosed vulnerability in widely self-hosted developer infrastructure can be weaponized at scale. Gitea instances often sit behind an organization's perimeter specifically because they hold source code, CI/CD secrets, and credentials for connected infrastructure — exactly the kind of access that turned a single vulnerable Git server into a foothold for exfiltrating SCADA/HMI source code and seizing root on a Proxmox virtualization cluster. The two-day gap between the patch shipping and confirmed active exploitation also underscores that "patch available" and "patched" are not the same thing for internet-facing self-hosted services, which frequently lag behind managed/cloud equivalents in update cadence.

Mitigation for Gitea Administrators

• Upgrade immediately to Gitea 1.27.1 or later on any self-hosted instance. Gitea Cloud environments were updated automatically, but self-managed installations require the administrator to apply the patch.
• Disable open self-registration if it is not required, closing off the path that lets an anonymous visitor obtain the repository write access needed to trigger the flaw.
• Audit recent repository and account activity for unfamiliar accounts, unexpected repositories, or suspicious patch/diff submissions, particularly around and after July 29, 2026.
• Check for persistence mechanisms consistent with JITTERLY and SIXZUT, including unexpected LD_PRELOAD entries, unfamiliar Git hook scripts, and unusual outbound tunneling traffic from the Gitea host.
• Review lateral-movement exposure from the Gitea host to adjacent infrastructure (virtualization hosts, CI/CD systems, credential stores) — the Taiwan Proxmox incident shows how far a single compromised Git server can reach.
• Treat exposed secrets in affected repositories as compromised and rotate them, since source code and credential theft were core objectives of this campaign.

Sources

• The Hacker News — Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
• The Hacker News — Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
• SOC Prime — CVE-2026-60004: Critical Gitea RCE Exploited to Deploy Miner-Like Payloads