Full Report
A Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. "Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems," Acronis Threat Research Unit (TRU) said in an
Analysis Summary
# Incident Report: Multi-National Gitea Exploitation by Red Heron
## Executive Summary
The Chinese threat actor "Red Heron" launched a global cyber-espionage campaign exploiting a critical RCE vulnerability in Gitea (CVE-2026-60004) to compromise 13 organizations across six countries. The attack progressed from automated scanning and source-code theft to full infrastructure compromise, including root access to virtualization clusters. The campaign focused heavily on Taiwan and sectors critical to national infrastructure, resulting in the theft of proprietary SCADA/IoT software and internal credentials.
## Incident Details
- **Discovery Date:** July 2026
- **Incident Date:** July 29, 2026 (Commencement of automated exploitation)
- **Affected Organizations:** 13 confirmed (including a Taiwanese industrial automation firm, an Argentine trading firm, and a Canadian energy company)
- **Sector:** Defense, Election, Energy, Aerospace, Telecommunications, Government, Public Safety, and Research
- **Geography:** Canada, Argentina, Taiwan, USA, Qatar, Sri Lanka
## Timeline of Events
### Initial Access
- **Date/Time:** July 29, 2026
- **Vector:** Exploitation of CVE-2026-60004 (Gitea RCE)
- **Details:** Red Heron weaponized a public proof-of-concept into an automated Python framework (`exp_enhanced.py`) to scan 1,386 Gitea instances and 477 Taiwan-based systems.
### Lateral Movement
- The actor used the compromised Gitea environment as a beachhead to move into internal networks.
- In a specific Taiwanese case, the actor moved from Gitea to gain root-level administrative access to a three-node Proxmox virtualization cluster.
### Data Exfiltration/Impact
- **Source Code:** Theft of hundreds of repositories (SCADA/HMI tools, IoT platforms, network sniffers).
- **Secrets:** Exfiltration of configuration secrets, internal tokens, and SSH host keys.
- **Intellectual Property:** AI chatbots, workflow automation tools, and internal business applications.
### Detection & Response
- **Discovery:** Identified by Acronis Threat Research Unit (TRU) through analysis of a staging server and post-exploitation implants.
- **Response Actions:** Analysis of the `JITTERLY` implant and `SIXZUT` rootkit to provide defensive signatures.
## Attack Methodology
- **Initial Access:** Automated exploitation of N-day vulnerability (CVE-2026-60004) in Gitea.
- **Persistence:** Use of `JITTERLY` C++ Linux backdoor and `SIXZUT` rootkit.
- **Privilege Escalation:** Gaining root access to Proxmox clusters.
- **Defense Evasion:** `SIXZUT` LD_PRELOAD rootkit patches 15 Linux functions to hide files, processes, and network connections.
- **Credential Access:** Theft of internal tokens and SSH host keys from repositories.
- **Discovery:** Infrastructure mapping of renewable energy and industrial firms; scanning for Joomla vulnerabilities.
- **Lateral Movement:** Network tunneling and internal pivoting via `JITTERLY`.
- **Collection:** Automated cloning of repositories and extraction of application secrets.
- **Exfiltration:** Transfer of data via command-and-control (C2) channels.
- **Impact:** Unauthorized access to critical development infrastructure and theft of proprietary IP.
## Impact Assessment
- **Financial:** High (Loss of proprietary industrial code and R&D).
- **Data Breach:** High volume (Hundreds of repositories and internal credentials).
- **Operational:** Disruption of development workflows; compromise of virtualization management (Proxmox).
- **Reputational:** Public exposure of critical infrastructure vulnerabilities in multiple countries.
## Indicators of Compromise
- **File Indicators:**
- `exp_enhanced.py` (Gitea exploit framework)
- `exp.py` (Joomla exploit script)
- `JITTERLY` (Linux backdoor)
- `SIXZUT` (LD_PRELOAD rootkit)
- **Behavioral Indicators:**
- Unauthorized account registration on Gitea instances.
- Modification of 15 standard Linux functions to hide processes.
- Automated repository cloning at high volume.
## Response Actions
- **Containment:** Identification and shutdown of the Red Heron staging server.
- **Eradication:** Guidance on identifying and removing the `SIXZUT` rootkit and `JITTERLY` implant.
- **Recovery:** Rotating all SSH keys and internal tokens found within compromised Gitea repositories.
## Lessons Learned
- **Exploit Speed:** The gap between vulnerability disclosure and automated exploitation by state-sponsored actors is now measured in days.
- **Self-Hosted Risks:** Self-hosted development platforms (Gitea) are high-value targets because they house "the keys to the kingdom" (source code and secrets).
- **Visibility Gaps:** Standard monitoring tools failed to detect the `SIXZUT` rootkit due to its ability to hook system functions.
## Recommendations
- **Patch Management:** Immediately patch Gitea instances to address CVE-2026-60004.
- **Secret Management:** Implement dedicated secret management solutions (e.g., HashiCorp Vault) so that code repositories do not contain plaintext tokens or SSH keys.
- **Integrity Monitoring:** Use Host-based Intrusion Detection Systems (HIDS) that monitor for `LD_PRELOAD` modifications and unauthorized system function hooking.
- **Network Segmentation:** Isolate development servers from critical virtualization management interfaces (like Proxmox).