Red Heron turned a public Gitea exploit into 13 confirmed compromises across six countries

Gitea holds the repositories. CVE-2026-60004 gives code execution on the host that holds them, and Acronis Threat Research Unit says the activity moved from there to credential collection, persistent access and lateral movement ^[15]. In one Taiwanese environment the path ended in root-level administrative access across a three-node Proxmox cluster ^[14]. From a Canadian renewable energy company the actor took repositories, configuration secrets, internal tokens, SSH host keys and internal applications ^[17]. A Taiwanese industrial automation firm lost hundreds of repositories covering a SCADA/HMI tool, IoT platform integrations, a network sniffer, server configurations and a surveillance and monitoring product ^[18].

"Within days of the vulnerability's July 2026 disclosure, Red Heron transformed public proof-of-concept code into an automated framework capable of registering accounts, exploiting vulnerable servers, stealing repositories, and removing selected traces," security researcher Subhajeet Singha said ^[3]. The framework, named exp_enhanced.py, has been in use since July 29, 2026 ^[2]. Those four functions sit in one tool, so the run from scan to exfiltration needs no operator at the keyboard.

Acronis counted 1,386 Gitea instances scanned across seven countries plus a separate dataset of 477 Taiwan-based systems ^[4], which is 1,863 hosts enumerated ^[7]. Thirteen confirmed compromises against the 1,386 scanned is 0.9 percent ^[6][8].

JITTERLY, the C++ Linux implant found on the staging server, supports more than 30 post-exploitation commands including shell execution, file transfer, network tunneling and internal pivoting ^[11]. It has been public since July 2026, when a researcher using the alias dmpdump described it and its overlaps with the AdaptixC2 agent ^[12]. The rootkit inside it, SIXZUT, is new to the record: an LD_PRELOAD component that hides files, processes and network connections by patching 15 Linux functions, and relaunches if it is terminated or removed ^[13].

Acronis, which is based in Singapore, assesses Red Heron as operating in a China-linked context with moderate confidence, citing Simplified Chinese in the tooling, the cluster's consistent classification of Taiwan as part of China, and a targeting footprint aligned with China's intelligence collection priorities ^[10]. The Simplified Chinese labels sort victims by sector: defense, election, energy, aerospace, telecommunications, government, public safety and research ^[9].

The Gitea flaw was a new input to a pipeline that already existed. Before cloning the CVE-2026-60004 exploit, the same infrastructure ran a Python script against 18 Joomla-based websites in 10 countries, among them an overseas education consulting firm in India and a US-based managed service provider ^[16]. The operators also carried out extensive enumeration of an Argentine quantitative trading firm ^[20]. "By combining automated Gitea exploitation with structured target selection, the actor progressed from repository theft to credential collection, persistent access, and lateral movement across victim environments," Singha said ^[21].