A cyber threat actor known as Red Heron, suspected to be linked to China, is responsible for swiftly exploiting a vulnerability in Gitea to compromise internet-exposed systems across multiple countries. The Acronis Threat Research Unit reported that Red Heron scanned over a thousand Gitea instances in seven countries, including a significant number in Taiwan, to execute their campaign. The breach impacted organizations in Canada, Argentina, Taiwan, the United States, Qatar, and Sri Lanka, targeting sectors such as defense, energy, telecommunications, and government.

Red Heron's activities progressed from stealing source code to gaining persistent access, collecting credentials, and moving laterally within networks. The attackers used Simplified Chinese to label targets, aligning with China's intelligence priorities. A key component of their toolkit is a C++ Linux implant called JITTERLY, which supports a variety of post-exploitation commands. Additionally, they deployed an undocumented LD_PRELOAD rootkit known as SIXZUT to hide their tracks and ensure persistence.

The attackers leveraged CVE-2026-60004, a critical Gitea remote code execution vulnerability, using an automated Python framework to exploit vulnerable servers. This framework allowed them to register accounts, exploit servers, steal data, and erase traces of their activity. Despite the sophistication of their methods, there is no evidence that artificial intelligence was used in developing the exploitation tools, according to security researcher Subhajeet Singha.

In some cases, such as in Taiwan, Red Heron managed to escalate their access from a vulnerable Gitea server to root-level control of a Proxmox cluster. This campaign underscores the risks associated with N-day vulnerabilities, particularly in self-hosted development platforms, highlighting the urgent need for organizations to secure their systems against such threats.