A threat actor known as Red Heron has leveraged a recently disclosed remote code execution vulnerability in Gitea to infiltrate internet-facing instances, compromising at least 13 organizations across six countries. The campaign reportedly began in July 2026, not long after exploit code for the flaw publicly surfaced. Victims span sectors such as defense, energy, elections, research, public safety, aerospace, telecommunications, and government. The operations reached Canada, the U.S., Argentina, Qatar, Sri Lanka, and Taiwan. The cybersecurity firm that tracked the activity links it with a China-connected context. Evidence includes labeling systems in Simplified Chinese, classifying Taiwan as part of China, and target selections aligning with known collection priorities.
How Red Heron Works
Initial reconnaissance involved scanning thousands of Gitea servers: about 1,386 across seven nations, with 477 instances in Taiwan alone. The actor converted proof-of-concept exploit scripts into an automated Python framework dubbed “exp_enhanced.py,” launched around July 29, 2026. This tool enables account registration on vulnerable servers, remote exploitation, repository theft, and erasure of selected traces.
Once inside, the attacker deployed a Linux implant named JITTERLY, which offers over 30 post-exploitation functions such as command execution, file transfer, termination of processes, network tunneling, interactive terminals, and pivoting within internal networks. In addition, Red Heron developed a new LD_PRELOAD rootkit, called SIXZUT, to hide its activity—concealing files, processes, connections, and surviving removal attempts.
Targets & Tactics
In Taiwan, the adversary elevated privileges from vulnerable Gitea servers through a three-node Proxmox cluster. An industrial automation firm in Taiwan lost hundreds of repositories tied to SCADA/HMI tools, IoT integrations, server configs, surveillance systems, monitoring tools and business apps. In Canada, a renewable energy firm saw its internal applications, SSH keys, repositories and secrets exfiltrated while detailed infrastructure mapping was underway. A Argentina-based quantitative trading company was thoroughly enumerated. In Qatar, a learning management system, chatbot framework, WordPress plugins and workflow tools were taken. The U.S. and Sri Lanka were also hit.
Other targets outside the core campaign included Joomla-based websites across 10 countries, comprising an Indian overseas education consulting firm and a U.S. managed service provider. The actor used a simpler script (“exp.py”) to go after these Joomla sites prior to refining their Gitea attack framework.
The threat actor was observed engaging in credential theft, persistent access, and lateral movement. Internal infrastructure was pivoted upon; credentials and tokens were extracted; root-level access achieved in some environments. The focus on sectors like elections, defense and energy suggests prioritized intelligence gathering over pure opportunism.
SINGHA, one of the researchers tracking the campaign, emphasized how rapidly—just days after a public vulnerability disclosure—Red Heron weaponized an N-day vulnerability to wreak havoc. The incident underscores the high stakes involved when self-hosted development platforms are compromised. The use of publicly available scripts to build fully automated attack frameworks shows how quickly exploits can evolve.
This case is tied to CVE-2026-60004, a critical remote code execution vulnerability in Gitea. The attack chain began with scanning, went through exploit deployment, and concluded in exfiltration, covering the full cycle from breach to stealth. The impact extends from source code theft and credentials exposure to persistent root-level control in critical infrastructure clusters.
Why this matters: Red Heron’s campaign illustrates the danger of rapid weaponization of vulnerabilities in open-source development tools. Organizations hosting internal platforms need to prioritize timely patching, keen monitoring, and segmentation. The blending of opportunistic scanning with strategic selection makes this kind of threat doubly dangerous. Security teams should watch for unexpected account creations, unusual network tunneling or file system anomalies. Expect similar campaigns now that CVE-2026-60004 proof-of-concept exploits are available—threat actors around the globe are likely watching.
