Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
Summary: A suspected China-linked threat actor tracked as Red Heron exploited a critical Gitea remote code execution flaw, CVE-2026-60004, to compromise 13 organizations across Canada, Argentina, Taiwan, the U.S., Qatar, and Sri Lanka after scanning 1,386 Gitea instances in seven countries and maintaining a separate dataset of 477 Taiwan-based systems. Acronis TRU said the actor turned public proof-of-concept code into an automated Python framework called exp_enhanced.py starting July 29, 2026, moving from source-code theft to credential collection, persistent access, and root-level control of a three-node Proxmox cluster, using a C++ Linux implant named JITTERLY and an LD_PRELOAD rootkit called SIXZUT that patches 15 Linux functions to hide files, processes, and connections.
What you should know: Thirteen confirmed victims in defense, election, energy, aerospace, telecommunications, government, public safety, and research came from a single self-hosted development platform flaw, and the actor went from public exploit code to a working automated framework within days of the July 2026 disclosure.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-60004
- Related
- CVE-2026-60004: Gitea Code Injection Vulnerability Known Exploited Vulnerabilities · Aug 25, 2026