An automated exploit built on a July Gitea bug is now doing espionage work. Acronis Threat Research Unit attributes the campaign to a suspected Chinese actor it has newly named Red Heron, which pointed the tooling at internet-facing servers.
Its scanning net covered 1,386 Gitea instances in seven countries, plus a separate list of 477 systems in Taiwan. Confirmed intrusions spanned Canada, Argentina, Taiwan, the US, Qatar, and Sri Lanka. Simplified Chinese labels sorted the targets across defense, election, energy, aerospace, telecommunications, government, and research.
The underlying flaw is CVE-2026-60004, a critical remote code execution bug. Public proof-of-concept code became an automated Python framework that registers accounts, exploits servers, steals repositories, and wipes selected traces.
Analysts pulled two tools off a staging server. The first is a C++ Linux implant named JITTERLY. It exposes more than 30 post-exploitation commands, spanning shell execution, file transfer, network tunneling, and internal pivoting. The second is an undocumented rootkit, SIXZUT, which uses LD_PRELOAD and patches 15 Linux functions to conceal files, processes, and connections while restarting itself when killed.
One Taiwanese victim saw the actor climb from a vulnerable Gitea host to root across a three-node Proxmox cluster. Elsewhere, repositories, internal tokens, SSH host keys, and configuration secrets were lifted. Before turning to Gitea, the same infrastructure hit Joomla sites in ten countries.
Acronis found no evidence AI wrote the framework, saying the operator reused existing tools.
