Red Heron turned a Gitea bug into an automated hacking framework within days, new research shows

A threat actor tracked as Red Heron turned a publicly disclosed Gitea vulnerability into a working automated exploitation framework within days of its release, according to research published September 14 by Acronis' Threat Research Unit. The campaign scanned 1,386 self-hosted Gitea instances across seven countries and confirmed compromises at 13 organizations across six countries: the United States (4), Taiwan (4), Canada (2), Argentina (1), Qatar (1), and Sri Lanka (1).

From proof-of-concept to production tool in days

The vulnerability, CVE-2026-60004, is a critical remote code execution flaw in Gitea, the self-hosted Git service used by organizations that don't want to rely on GitHub or GitLab for source control. It was publicly disclosed in July 2026. Red Heron began active exploitation on July 29 — turning a public proof-of-concept into exp_enhanced.py, an automated Python framework capable of registering accounts, exploiting vulnerable servers, stealing entire code repositories, and selectively removing traces of the intrusion. The speed of that conversion, researchers noted, reflects how thin the window has become between a vulnerability's disclosure and its weaponization at scale.

A new rootkit built to hide in plain sight

Once inside a target, Red Heron deployed two custom tools researchers had not previously catalogued. SIXZUT is a Linux rootkit that uses the LD_PRELOAD technique to patch 15 different Linux kernel-adjacent functions, hiding malicious files, processes, and network connections from standard detection tools and administrators. JITTERLY is a C++ backdoor supporting more than 30 post-exploitation commands — shell execution, file transfer, process termination, network tunneling, interactive terminal access, and internal network pivoting. In one confirmed Taiwanese environment, Acronis TRU traced Red Heron's progression from an initially compromised Gitea server to root-level administrative access across an entire three-node Proxmox virtualization cluster.

Who was targeted, and why it matters

Confirmed and attempted targets span defense, election infrastructure, energy, aerospace, telecommunications, government, public safety, and research sectors — a target profile that points toward intelligence collection rather than financially motivated cybercrime. Researchers attribute the campaign to a China-linked actor with moderate confidence, based on Simplified Chinese-language artifacts in tooling, a Taiwan-specific targeting and classification methodology within the attacker's own operational data, and a target set that aligns with known Chinese intelligence priorities.

The self-hosted software risk this exposes

Gitea's appeal is precisely that it lets organizations run Git infrastructure without depending on GitHub or GitLab — but that same self-hosted independence means patching is entirely the operator's responsibility, with no forced update cycle from a SaaS provider. Organizations running self-hosted Gitea instances should treat CVE-2026-60004 as actively and automatically exploited in the wild, not a theoretical risk, and should assume any unpatched internet-facing instance has likely already been scanned by Red Heron's tooling. The compromised repositories are also a supply-chain risk in their own right: source code theft from defense, aerospace, and energy sector targets can seed follow-on attacks against downstream customers and partners.