INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Worldwide

| 2026-09-16 02:30 HIGH MEDIUM EXPLOITED VULNERABILITY VULNERABILITY DISCLOSURE MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
A multinational campaign was launched in September 2026, where a Chinese-speaking threat actor, tracked as Red Heron, exploited CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management platform. The attack affected organizations in Canada (2), Argentina (1), Taiwan (4), the U.S. (4), Qatar (1), and Sri Lanka (1). Red Heron scanned 1,386 Gitea instances across seven countries before maintaining persistent access, credential collection, and lateral movement. The attackers used a C++ Linux implant dubbed JITTERLY to support over 30 post-exploitation commands, including shell execution and network tunneling. A previously undocumented LD_PRELOAD rootkit called SIXZUT was also found within the backdoor, capable of hiding files and processes by patching 15 different Linux functions.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-60004 and treat internet-facing systems that were not patched in time as potentially compromised until verified.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 7 IoCs Create Free Account
ex•••••.py
ex•••••.py
28b132••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
b441f7••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
xc•••••.com
s2•••••.xyz
98•••••.xyz
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-60004CVE-2026-60004
Target & Sectors
NORTH_AMERICA NORTH_AMERICA governmentgovernment technologytechnology telecommunicationstelecommunications aerospaceaerospace defensedefense energyenergy
Incident Timeline
‎July 2026
Threat actors, including Red Heron, rapidly adapted public proof-of-concept code into an automated framework exploiting a Gitea n-day flaw in July 2026.
‎July 29, 2026
Threat actors used the CVE-2026-60004 Gitea remote code execution vulnerability to create an automated Python framework ("exp_enhanced.py") that exploited a publicly available flaw, targeting thousands of instances across seven countries starting July 29, 2026.
industry Technology
General Document Context
vulnerability CVE-2026-60004
Red Heron has been observed weaponizing CVE-2026-60004 , a critical Gitea remote code execution vulnerability, to scan thousands of instances across seven countries, turning a publicly-available exploit for the flaw into a full-fledged automated Python framework ("exp_enhanced.py") starting July 29, 2026.
tactic Remote Code Execution
Red Heron has been observed weaponizing CVE-2026-60004 , a critical Gitea remote code execution vulnerability, to scan thousands of instances across seven countries, turning a publicly-available exploit for the flaw into a full-fledged automated Python framework ("exp_enhanced.py") starting July 29, 2026.
observable exp_enhanced.py
Red Heron has been observed weaponizing CVE-2026-60004 , a critical Gitea remote code execution vulnerability, to scan thousands of instances across seven countries, turning a publicly-available exploit for the flaw into a full-fledged automated Python framework ("exp_enhanced.py") starting July 29, 2026.
tactic T1059.006 - Python
Red Heron has been observed weaponizing CVE-2026-60004 , a critical Gitea remote code execution vulnerability, to scan thousands of instances across seven countries, turning a publicly-available exploit for the flaw into a full-fledged automated Python framework ("exp_enhanced.py") starting July 29, 2026.
‎Sep 14, 2026
Threat actors exploited a four-day-old Gitea vulnerability to deliver a new Linux rootkit, targeting multinational organizations.
industry Technology
General Document Context
‎2026/09/16
A Chinese-speaking threat actor, tracked as Red Heron, rapidly exploited a recently disclosed security vulnerability in Gitea to compromise internet-facing instances across seven countries.
infrastructure Linux
IOC - Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit.
An analysis of a staging server attributed to the adversary has uncovered a C++ Linux implant dubbed JITTERLY, which supports more than 30 post-exploitation commands related to shell execution, file transfer, process termination, network tunneling, interactive terminal access, and internal pivoting.
Present within the backdoor is a previously undocumented LD_PRELOAD rootkit called SIXZUT that's capable of hiding files, processes, and network connections by patching 15 different Linux functions to cover up traces of malicious activity and prevent the malware from being detected and killed, as well as relaunching if it gets terminated or removed.
organisation IOC - Red Heron
IOC - Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit.
organisation Gitea
IOC - Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit.
"Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems," Acronis Threat Research Unit (TRU) said in an analysis.
organisation LD_PRELOAD
Present within the backdoor is a previously undocumented LD_PRELOAD rootkit called SIXZUT that's capable of hiding files, processes, and network connections by patching 15 different Linux functions to cover up traces of malicious activity and prevent the malware from being detected and killed, as well as relaunching if it gets terminated or removed.
organisation Threat Research Unit
Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management platform.
organisation Red Heron
Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management platform.
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries.
organisation Compromise 13 Organizations Across Six Countries
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries.
victims 13 Organizations
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries.
organisation IoT
Exfiltrating data from a Taiwanese industrial automation company, including hundreds of repositories related to a SCADA/HMI tool, IoT platform integrations, a network sniffer, server configurations, a surveillance and monitoring product, and internal business applications.
organisation SSH
Conducting extensive infrastructure mapping of a Canadian renewable energy company, exfiltrating repositories, configuration secrets, internal tokens, SSH host keys, and internal applications.
organisation Cyber Espionage / Vulnerability
Cyber Espionage / Vulnerability A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign.
Tactical Metrics
Metrics
infrastructure
‎Linux
Affected Product
IOC - Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit.
An analysis of a staging server attributed to the adversary has uncovered a C++ Linux implant dubbed JITTERLY, which supports more than 30 post-exploitation commands related to shell execution, file transfer, process termination, network tunneling, interactive terminal access, and internal pivoting.
Present within the backdoor is a previously undocumented LD_PRELOAD rootkit called SIXZUT that's capable of hiding files, processes, and network connections by patching 15 different Linux functions to cover up traces of malicious activity and prevent the malware from being detected and killed, as well as relaunching if it gets terminated or removed.
Metrics
victims
13
Organizations
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries.
Intelligence Sources
The Hacker News 2026-09-14
AlienVault OTX 2026-09-16