Red Heron Exploits Critical Gitea RCE (CVE-2026-60004) to Compromise 13 Organizations, Steal Source Code and Deploy Linux Rootkit
China-linked Red Heron rapidly weaponized Gitea RCE CVE-2026-60004 (CVSS 9.8) into an automated framework, compromising 13 organizations across up to six countries, stealing source code and credentials, and deploying the JITTERLY implant with the SIXZUT…
Acronis Threat Research Unit attributes a campaign to a Chinese-speaking, China-nexus actor tracked as Red Heron (linkage assessed with moderate confidence), which rapidly exploited Gitea RCE CVE-2026-60004 (CVSS 9.8, affecting versions 1.17 through 1.27.0, fixed in 1.27.1 released July 27, 2026) shortly after its July 2026 disclosure. Within days of a public PoC appearing, the actor weaponized it into an automated Python framework that registered accounts, exploited servers, stole repositories, and removed traces. The actor scanned 1,386 internet-exposed Gitea instances across seven countries and maintained a separate list of 477 Taiwan-based targets spanning defense, energy, elections, and AI sectors. Thirteen organizations were confirmed compromised; Report 1 lists victims across six countries (Canada, Argentina, Taiwan, the U.S., Qatar, and Sri Lanka), while Reports 2 and 3 list five, omitting Qatar. Intrusions deployed the JITTERLY C++ Linux implant, which supports 30+ post-exploitation commands and uses AES-128-GCM-encrypted C2 with an Adaptix-like protocol, alongside the previously undocumented SIXZUT LD_PRELOAD rootkit, installed via /etc/ld.so.preload and disguised as libglthread.so.2 to hide files, processes, and network connections while evading admin tools. Stolen material included source code, password hashes, and SSH keys. A Canadian renewable-energy firm was compromised across 22 sessions, and a Taiwanese industrial automation firm lost hundreds of repositories including SCADA/HMI tools. In one Taiwanese environment the actor gained root-level access across a three-node Proxmox cluster, risking exposure of full VM disk image backups. Targeted sectors include defense, elections, energy, aerospace, telecom, government, and research. Acronis recommends rotating all secrets on compromised Gitea servers, including tokens, SSH keys, and source code.
- CVE-2026-60004 is a critical Gitea RCE (CVSS 9.8) affecting versions 1.17 through 1.27.0, fixed in version 1.27.1 released July 27, 2026
- Acronis assesses China linkage for Red Heron with moderate confidence; the actor is described as Chinese-speaking
- 13 organizations confirmed compromised; Report 1 lists six victim countries (Canada, Argentina, Taiwan, U.S., Qatar, Sri Lanka) while Reports 2 and 3 list five, omitting Qatar
- Actor scanned 1,386 internet-exposed Gitea instances across seven countries and held a separate list of 477 Taiwan-based targets
- Weaponized a public PoC within days into an automated Python framework for account registration, exploitation, repository theft, and trace removal
- JITTERLY C++ Linux implant supports 30+ post-exploitation commands with AES-128-GCM-encrypted C2 using an Adaptix-like protocol
- SIXZUT LD_PRELOAD rootkit persists via /etc/ld.so.preload disguised as libglthread.so.2, hiding files, processes, and network connections from admin tools
- A Canadian renewable-energy firm was hit in 22 sessions; a Taiwanese industrial automation firm lost hundreds of repositories including SCADA/HMI tools
Coverage timelineoldest first · each row is one article
- · 1d agoRed Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
The Hacker News· 78
China-linked Red Heron exploited Gitea RCE CVE-2026-60004 to compromise 13 organizations across six countries, stealing source code.
- · 11h agoHackers Actively Exploiting Gitea n-day RCE Vulnerability in the Wild to Hijack Instances
Cyber Security News· 80
Chinese-speaking Red Heron actors mass-exploit Gitea n-day RCE CVE-2026-60004 to steal source code, credentials, and pivot into victim networks.
- · 10h agoRed Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit
GBHackers· 84
PRC-linked Red Heron exploits critical Gitea RCE CVE-2026-60004 to steal source code and deploy JITTERLY implant with SIXZUT LD_PRELOAD rootkit; victims span five countries.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-60004 | Unauthenticated RCE in Gitea via diffpatch API Git Hook Injection Gitea before 1.27.1 contains a critical code injection flaw (CWE-94) in the diffpatch API that allows remote code execution by causing the installation of a Git hook. An attacker can submit a crafted request through the diffpatch API to plant a Git hook, which then executes arbitrary shell commands on the server when Git operations run; the CVSS vector indicates the attack requires no authentication or user interaction, while public reporting describes attackers with repository write access planting hooks to run shell commands. Successful exploitation yields full server compromise (confidentiality, integrity, and availability all rated high), and observed attacks have reportedly dropped a cryptocurrency miner. All Gitea deployments running versions prior to 1.27.1 are affected, with internet-facing instances at greatest risk; public scans identified over 8,300 vulnerable Gitea servers. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-25, and EPSS estimates an 86.8% probability of exploitation within 30 days. Do: Upgrade Gitea to version 1.27.1 or later immediately; organizations subject to BOD 26-04 must apply the vendor mitigation or discontinue use of unpatched cloud-hosted instances. Until patched, limit internet exposure of Gitea servers and inspect repository hook directories for unauthorized or recently modified hooks that could serve as persistence. Check for signs of compromise, including unexpected processes or cryptocurrency-miner activity, since in-the-wold attacks reportedly deploy a miner. | 9.8 | 87% | KEV PoC ×4 |
| moderate≈8,300+ internet-exposed Gitea servers (public scan count) |