Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit

A Chinese-speaking threat actor known as Red Heron has exploited a critical remote code execution (RCE) vulnerability in Gitea to steal private source code, harvest credentials, establish persistent access, and move laterally within victim infrastructures.

Researchers from the Acronis Threat Research Unit (TRU) have linked this operation to a newly documented Linux implant called JITTERLY, which contains an embedded LD_PRELOAD rootkit named SIXZUT.

Rapid Gitea Exploitation

The campaign leverages CVE-2026-60004, a critical vulnerability in Gitea with a CVSS v3.1 score of 9.8. This flaw affects Gitea versions 1.17 through 1.27.0 and was patched in version 1.27.1, released on July 27, 2026. Public technical details and proof-of-concept code emerged a day later.

The vulnerability arises from issues within Gitea’s diffpatch workflow. Under vulnerable configurations, crafted repository patches can lead Git to write an attacker-controlled file into an active hooks directory, allowing commands to execute in the context of the Gitea service account.

Open user registration significantly lowers the barrier to exploitation, letting attackers register an account, create a repository, and trigger the attack without stolen credentials.

According to TRU, Red Heron began adapting a public proof-of-concept on July 29 and quickly developed an automated exploitation framework.

This tooling can process target lists, identify systems that allow user registration, automatically create accounts, execute the RCE chain, extract repository data from compromised hosts, and attempt to erase selected artifacts afterward.

The actor conducted scans on 1,386 internet-exposed Gitea instances across seven countries and compiled a separate list of 477 systems based in Taiwan.

Recovered reconnaissance records classified targets in Simplified Chinese across various sectors, including defense, elections, energy, aerospace, telecommunications, government, research, cloud services, developer tooling, and artificial intelligence.

TRU identified confirmed exploitation evidence involving organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. A renewable-energy organization in Canada received specific attention, with 22 documented exploitation sessions.

The attacker accessed application repositories, authentication services, customer relationship management (CRM) and human resources (HR)-related systems, internal reports, APIs, configuration files, tokens, SSH host keys, and deployment credentials.

In another incident, Red Heron compromised a Taiwanese industrial automation environment and exfiltrated hundreds of repositories. Stolen materials included apparent monitoring and surveillance components, SCADA/HMI-related tools, IoT integrations, network-sniffing utilities, server configurations, and internal business applications.

TRU traced JITTERLY to an exposed Red Heron staging server that contained command history, target databases, exploitation tools, malware, and stolen repositories.

This C++ Linux implant supports over 30 commands for shell execution, file movement, data transfer, host enumeration, interactive terminal access, tunneling, reverse port forwarding, and internal pivoting. Its communication protocol resembles the Linux agent used by the open-source Adaptix C2 framework, though JITTERLY employs AES-128-GCM for encrypted communications.

JITTERLY also decrypts and deploys SIXZUT, a previously unreported shared-library rootkit disguised as libglthread.so.2. By using /etc/ld.so.preload, SIXZUT can be loaded into dynamically linked processes, hiding malicious files, processes, network connections, and persistence artifacts from common administrative tools.

The rootkit filters filesystem and process listings, conceals configured connections from /proc-based tools and Netlink queries, and interferes with attempts to terminate protected processes. When operating with root privileges, it can also relaunch the JITTERLY implant if its binary remains present, but the process is stopped.

Red Heron’s most significant lateral movement activity involved a Taiwanese Synology-hosted environment. After gaining initial access to Gitea, the operator obtained a Proxmox root@pam authentication ticket, deployed payloads to three cluster nodes, and initiated VM backup operations using vzdump. Successfully collecting those backups could expose entire virtual machine disk images, not just source-code repositories.

TRU assesses with moderate confidence that Red Heron operates in a context linked to the People’s Republic of China (PRC), citing Simplified Chinese operational artifacts, target classification practices, metadata that treats Taiwan as a Chinese region, and targeting that aligns with strategic intelligence collection. Researchers have not yet associated the activity with any known advanced persistent threat (APT) group.

Organizations that operate self-hosted Gitea should upgrade to version 1.27.1 or later, disable unnecessary public registration, review Git and Gitea logs, rotate exposed secrets, and investigate any unexpected SSH keys, LD_PRELOAD entries, and unfamiliar processes.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.