From Gitea Exploitation to Root Access: Uncovering Red Heron’s Global Attack Campaign

Summary

Red Heron demonstrates how quickly a newly disclosed vulnerability in internet-facing development infrastructure can evolve into a broader enterprise compromise. The suspected China-linked threat actor weaponized the critical Gitea vulnerability CVE-2026-60004 within days of public disclosure, converting publicly available proof-of-concept code into an automated framework capable of identifying vulnerable servers, creating accounts, executing code, collecting repositories, and removing selected traces. What began as exploitation of self-hosted source-code infrastructure progressed into credential collection, persistent access, lateral movement, malware deployment, and ultimately root-level access to virtualization infrastructure. The campaign also exposed two significant Linux threats: the JITTERLY post-exploitation implant and the previously undocumented SIXZUT rootkit.

Background of Red Heron

Red Heron is the name assigned by the Acronis Threat Research Unit (TRU) to a threat actor uncovered during threat-hunting activity in August 2026. Investigators traced a suspicious Linux implant to an exposed staging server controlled by the actor. The server unintentionally provided researchers with extensive visibility into the operation, including exploitation scripts, reconnaissance databases, command history, stolen repositories, malware, and post-exploitation tooling.

The recovered infrastructure showed that Red Heron had developed a structured reconnaissance process around internet-facing Gitea installations. The actor scanned 1,386 Gitea instances across seven countries and maintained a separate dataset containing 477 Taiwan-based systems. Potential targets were categorized using Simplified Chinese labels covering sectors such as defense, elections, energy, aerospace, telecommunications, government, public safety, research, cloud services, and developer infrastructure.

Vulnerability Details

CVE ID	CVSS Score	EPSS Score	Affected Versions	Vulnerability Type
CVE-2026-60004	9.8 (Critical)	86.78%	Gitea 1.17 through 1.27.0	Remote Code Execution

CVE-2026-60004 is a critical remote code execution vulnerability affecting Gitea's diffpatch functionality. The flaw exists in the way repository patches were processed inside a temporary Git repository.

Under vulnerable conditions, specially crafted patch operations could cause Git to place attacker-controlled content into an executable hook location. When Git subsequently processed the repository index, the malicious hook could execute commands with the privileges of the Gitea service account.

Attack Methodology

• Phase 1: Reconnaissance and Target Identification
  Red Heron scans internet-facing Gitea servers, classifies targets by sector and intelligence value, and prioritizes exposed instances that permit open account registration or otherwise present exploitable conditions.
• Phase 2: CVE-2026-60004 Exploitation
  The threat actor exploits the vulnerable Gitea patch-processing workflow to achieve remote code execution. Public proof-of-concept code was rapidly adapted into an automated exploitation framework for large-scale use.
• Phase 3: Repository, Data, and Credential Collection
  After gaining access, Red Heron collects source code, configuration files, application secrets, tokens, SSH-related material, and Gitea database contents, then extracts or cracks credentials that can enable deeper access into the environment.
• Phase 4: Persistence and Malware Deployment
  The actor establishes additional access through SSH-based persistence, disguised services, and backdoors. Selected systems are also infected with JITTERLY, a Linux post-exploitation implant capable of command execution, file transfer, tunneling, scanning, and remote control.
• Phase 5: SIXZUT Rootkit and Lateral Movement
  JITTERLY deploys the SIXZUT rootkit to hide malicious files, processes, and network activity. Stolen credentials, SSH access, and network tunnels are then used to pivot from the compromised Gitea server into additional internal systems.
• Phase 6: Root-Level Infrastructure Compromise
  The intrusion can culminate in privileged access to critical infrastructure. In one documented environment, Red Heron progressed from a compromised Gitea server to administrative control of a three-node Proxmox virtualization cluster.

Impact

1. Source Code Theft: Attackers can obtain proprietary repositories containing application logic, internal tools, infrastructure definitions, and sensitive development information.
2. Credential and Secret Exposure: Repository contents and Gitea data may contain API tokens, database credentials, SSH keys, service passwords, internal certificates, and deployment secrets.
3. Persistent Server Access: Backdoors, SSH keys, JITTERLY, and SIXZUT can allow attackers to maintain access even after the vulnerable Gitea entry point is patched.
4. Lateral Movement: Stolen credentials and network tunneling capabilities can allow the attacker to pivot from the Gitea host into internal applications, servers, NAS systems, or virtualization infrastructure.
5. Root-Level Infrastructure Compromise: The campaign demonstrates that exploitation of a source-code management server can eventually lead to privileged access to connected infrastructure, including virtualization hosts.

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic
T1190	Exploit Public-Facing Application	Initial Access
T1136	Create Account	Persistence
T1059.004	Command and Scripting Interpreter: Unix Shell	Execution
T1005	Data from Local System	Collection
T1110.002	Brute Force: Password Cracking	Credential Access
T1098.004	Account Manipulation: SSH Authorized Keys	Persistence

Visual Attack Flow

Mitigation

1. Upgrade Gitea to version 1.27.1 or later immediately. CVE-2026-60004 affects Gitea versions 1.17 through 1.27.0. Systems still running a vulnerable release, particularly internet-facing installations, should be treated as a high-priority remediation target.
2. Disable unnecessary open registration. Where public account creation is not operationally required, disable it. Open registration can allow an external attacker to create the repository access required to reach the vulnerable workflow without first compromising an existing account.
3. Reduce direct internet exposure. Avoid exposing self-hosted Gitea instances directly to the public internet where possible. Place administrative and development infrastructure behind a VPN, identity-aware proxy, authenticated reverse proxy, or other access-control layer.
4. Review accounts and repositories created after disclosure. Investigate unexpected accounts, temporary repositories, or unusual repository creation activity beginning around the disclosure of CVE-2026-60004. Red Heron's automation created disposable accounts and repositories as part of its exploitation workflow.
5. Inspect Gitea and reverse-proxy logs. Search for unusual access to Gitea's patch-processing functionality, abnormal account registration, unusual repository activity, and suspicious requests to application endpoints that do not match normal administrative or development behavior.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that helps organizations rapidly fix vulnerabilities before attackers can exploit the exposure window. The software supports major operating systems such as Windows, Linux, and macOS, along with 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.