Red Heron Breaches Source-Code Servers and Establishes Stealthy Linux Persistence
A Chinese-speaking threat actor tracked as Red Heron has weaponized a critical Gitea vulnerability to compromise internet-facing development servers, steal source code and credentials, and expand deeper into victim networks.
Acronis Threat Research Unit (TRU) linked the campaign to CVE-2026-60004, a critical remote-code-execution vulnerability affecting Gitea versions 1.17 through 1.27.0.
The flaw was fixed in Gitea 1.27.1 on July 27, but researchers found Red Heron adapting publicly available exploit code into an automated attack framework within days.
Public Exploit Quickly Becomes an Attack Framework
CVE-2026-60004 affects Gitea's diffpatch functionality and can allow repository-controlled content to install and execute a malicious Git hook.
Open Registration Expands the Attack Surface
Exploitation requires ordinary repository write permissions. But on Gitea deployments permitting public account registration, an outside attacker can potentially register, create a repository and obtain the access required to trigger the flaw.
Red Heron automated much of this process, turning public proof-of-concept research into tooling capable of identifying targets, registering accounts, executing commands, stealing repositories and removing selected traces.
Source-Code Theft Escalates Into Network Compromise
Acronis identified 13 confirmed compromised organizations across six countries, while the actor's reconnaissance covered substantially more infrastructure.
Sensitive Development Assets Were Exfiltrated
Victims included organizations connected to industrial automation, energy, technology and other sectors.
At one Taiwanese industrial target, attackers stole hundreds of repositories involving SCADA/HMI technology, IoT integrations, network monitoring, surveillance systems and internal applications.
One Intrusion Reached Virtualization Infrastructure
The campaign did not stop at Gitea.
In one Taiwanese environment, Red Heron moved from the compromised development server to root-level access across a three-node Proxmox cluster, demonstrating how a vulnerable code repository can become an entry point into broader infrastructure.
JITTERLY Provides Post-Exploitation Control
Researchers uncovered a Linux implant called JITTERLY, offering more than 30 post-exploitation capabilities.
Implant Supports Pivoting and Remote Operations
Its functionality includes command execution, file transfers, network tunneling, interactive terminal access and internal network pivoting.
The malware gives operators a flexible platform for maintaining access after the initial Gitea compromise.
SIXZUT Rootkit Conceals the Intrusion
Embedded within JITTERLY is a previously undocumented LD_PRELOAD rootkit tracked as SIXZUT.
Linux Functions Are Manipulated to Hide Activity
SIXZUT hooks 15 Linux functions to conceal malicious files, processes and network connections.
It can also interfere with attempts to terminate the implant and relaunch malicious components when conditions allow, making compromised servers significantly harder to investigate using ordinary host-level tools.
Developer Infrastructure Is Becoming a High-Value Target
Red Heron's operation demonstrates why self-hosted development platforms deserve the same defensive priority as other internet-facing enterprise infrastructure.
A compromised source-code server can expose far more than repositories. Configuration files may contain API tokens, SSH material, deployment credentials, CI/CD secrets and information about internal architecture, giving attackers potential routes into production environments.
The campaign illustrates a broader shift in exploitation: development platforms are valuable not only for the code they store, but for the privileged relationships they maintain with the infrastructure that builds, deploys and operates that code.