Red Heron Exploits Gitea Vulnerability in Multinational Cyber Campaign

• •Red Heron exploited CVE-2026-60004 in Gitea, affecting 1,386 instances across seven countries.
• •The campaign involved source-code theft and lateral movement, impacting multiple sectors.
• •JITTERLY implant and SIXZUT rootkit were used for post-exploitation activities.

A Chinese-speaking threat actor known as Red Heron has exploited CVE-2026-60004, a recently disclosed remote code execution vulnerability in Gitea, to compromise 1,386 instances across seven countries. The campaign has led to confirmed breaches affecting organizations in Canada, Argentina, Taiwan, the United States, Qatar, and Sri Lanka. Red Heron utilized an automated framework to scan for vulnerabilities, leading to source-code theft, credential collection, and lateral movement within compromised networks. The actor's operations included root-level access to a three-node Proxmox cluster and the deployment of a C++ Linux implant named JITTERLY, which supports over 30 post-exploitation commands. Additionally, a previously undocumented rootkit, SIXZUT, was discovered, capable of hiding malicious activities. The rapid exploitation of this n-day vulnerability highlights the risks associated with self-hosted development platforms. Current assessments indicate Red Heron operates within a context linked to the People's Republic of China.