Executive Summary
Acronis Threat Research Unit has identified a multi-national campaign by a suspected Chinese threat actor named Red Heron, targeting self-hosted Gitea instances. The actor rapidly weaponized CVE-2026-60004, a critical remote code execution vulnerability in Gitea, within days of its July 2026 disclosure. The campaign has affected at least 13 organizations across sectors including defense, energy, government, and aerospace in countries such as Taiwan, the U.S., Canada, and Argentina.
The attack chain involves automated scanning and exploitation to achieve repository theft, followed by the deployment of the JITTERLY implant—a C++ backdoor sharing tradecraft with the AdaptixC2 framework. JITTERLY contains SIXZUT, a previously undocumented LD_PRELOAD rootkit that hides files, processes, and network connections while ensuring the implant's persistence. In one instance, the actor successfully transitioned from a compromised Gitea server to root-level access on a three-node Proxmox cluster.
This activity represents a significant risk to organizations using self-hosted development platforms, as Red Heron demonstrates high proficiency in lateral movement and intelligence collection. The actor's use of Simplified Chinese metadata and specific targeting of Taiwan-based assets suggests an operational context linked to PRC strategic priorities. Immediate patching of Gitea to version 1.27.1 or later is required.