Red Heron Cyber Espionage Campaign Exploits Gitea RCE Vulnerability to Target 13 Global Organizations

A suspected Chinese threat actor, Red Heron, exploited the critical Gitea RCE vulnerability CVE-2026-60004 to compromise 13 organizations across six countries, using custom malware like JITTERLY and SIXZUT for persistent access and data exfiltration. The campaign targeted sectors including defense, energy, and government, demonstrating rapid weaponization of N-day vulnerabilities in self-hosted development platforms.

A suspected Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign.

"Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems," Acronis Threat Research Unit (TRU)

Read original article