Red Heron Exploits Gitea RCE Flaw in Multinational Campaign

• •Red Heron exploited CVE-2026-60004 in Gitea, compromising 1,386 instances.
• •The campaign affected organizations in five countries, including sensitive sectors.
• •Acronis identified JITTERLY and SIXZUT as key tools used in the attack.

A Chinese-speaking threat actor, tracked as Red Heron, exploited the CVE-2026-60004 remote code execution vulnerability in Gitea, compromising 1,386 instances across seven countries. The campaign involved source-code theft, credential collection, and lateral movement, affecting organizations in Canada, Argentina, Taiwan, the U.S., and Sri Lanka. Red Heron utilized an automated exploitation framework to register accounts and steal repositories, including sensitive data from a Taiwanese industrial automation company. Acronis Threat Research Unit identified a Linux implant named JITTERLY and a previously undocumented rootkit called SIXZUT, which can hide malicious activity. The campaign highlights the rapid exploitation of n-day vulnerabilities in self-hosted platforms. Red Heron is assessed to operate within a PRC-linked context based on its targeting methodology and language used.