Red Heron: Gitea Prometheus metrics endpoint used as disguised C2 channel

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•0

Detects network requests to the Gitea Prometheus metrics API that contain 'k=' and 'x=' query parameters, a pattern indicative of a C2 command channel disguised as legitimate telemetry traffic.