A suspected Chinese threat actor tracked as Red Heron turned a public proof-of-concept for CVE-2026-60004 — a critical remote code execution vulnerability in Gitea — into an automated attack framework within days of the flaw’s July 2026 disclosure. Acronis Threat Research Unit, which attributed the campaign, says Red Heron scanned 1,386 internet-facing Gitea instances across seven countries and confirmed breaches at 13 organizations in Canada, Argentina, Taiwan, the United States, Qatar, and Sri Lanka. Targeted sectors include defense, elections, energy, aerospace, telecommunications, government, and research — a list that closely matches China’s stated intelligence collection priorities. The actor used Simplified Chinese labels throughout its staging infrastructure and consistently classified Taiwan as part of China.
From initial access, Red Heron moved quickly from source-code theft to persistent footholds and lateral movement. The group deployed a C++ Linux implant called JITTERLY that supports over 30 post-exploitation commands covering shell execution, file transfer, network tunneling, and interactive access. It also installed SIXZUT, a previously undocumented LD_PRELOAD rootkit that patches 15 Linux kernel functions to hide files, processes, and network connections, and automatically relaunches if the implant is killed or removed. In one Taiwanese victim environment, Red Heron escalated from a vulnerable Gitea server to root-level access across a three-node Proxmox cluster.
How to check if you’re affected
Affected versions include all Gitea instances running versions prior to the CVE-2026-60004 fix released in July 2026. If you operate a self-hosted Gitea server, check your installed version at Admin > Site Administration > Configuration and compare against Gitea’s official releases page. Indicators of compromise to look for include unexpected user accounts registered on your Gitea instance, unusual outbound connections from the Gitea server host, and the presence of Python scripts named exp_enhanced.py or binaries named JITTERLY in your file system. Given the rootkit’s ability to hide running processes, review logs from before any suspected intrusion date rather than relying solely on current process lists.