Red Heron Weaponizes Gitea Flaw in Global Campaign, Deploys New Linux Rootkit

Acronis Threat Research Unit (TRU) has uncovered a multinational cyber campaign in which a Chinese-speaking threat actor tracked as Red Heron rapidly weaponized a critical Gitea vulnerability and used compromised development infrastructure to steal source code, collect credentials, establish persistence and move deeper into victim environments.

The campaign centred on CVE-2026-60004, a critical remote code execution vulnerability in Gitea. According to Acronis, the vulnerability was patched by Gitea on July 27, 2026, but Red Heron began adapting publicly available proof-of-concept code within days.

The investigation also uncovered JITTERLY, a C++ Linux implant with more than 30 post-exploitation capabilities, and an embedded Linux rootkit that Acronis tracks as SIXZUT.

Acronis says the rootkit had not previously been publicly reported.

The investigation was possible because researchers traced JITTERLY back to an exposed staging server containing the actor's exploitation tools, reconnaissance databases, command history, stolen repositories and malware.

A Gitea vulnerability becomes the entry point

CVE-2026-60004 is a critical remote code execution vulnerability in Gitea with a CVSS v3.1 score of 9.8.

Acronis reports that the flaw affects Gitea versions 1.17 through 1.27.0 and was fixed in Gitea 1.27.1, released on July 27, 2026. The full security advisory and a working proof of concept followed the next day.

The vulnerability exists in Gitea's diffpatch functionality.

At a high level, the vulnerable workflow processes repository patches inside a temporary Git clone. The affected implementation used a bare repository and enabled Git's three-way merge functionality.

A specially crafted patch submitted through the vulnerable workflow could cause Git to write a file into the repository's active hook directory. That file could subsequently execute with the privileges of the Gitea service account.

The situation became more serious on installations where open registration remained enabled.

In that configuration, an attacker could register an account, create a repository and reach the vulnerable functionality without already possessing an account on the server.

Gitea addressed the issue by changing the temporary clone from bare to non-bare, removing the hook installation path that enabled the exploitation chain.

From public PoC to automated exploitation

The speed of Red Heron's activity is one of the most notable elements of the investigation.

According to Acronis, the operator cloned a publicly available CVE-2026-60004 proof of concept from GitHub on July 29, only days after the vulnerability was patched and publicly documented.

The operator then modified the code, tested it and eventually developed its own exploitation tooling.

By July 30, the actor had scanned 1,386 Gitea instances across seven countries.

The scanning process included automated registration probes designed to identify systems where account registration remained available.

A separate dataset contained 477 Taiwan-based Gitea systems.

By early August, the tooling had evolved into an automated framework that could:

• Process target lists

• Register accounts automatically

• Exploit vulnerable Gitea instances

• Extract repositories

• Remove selected traces from the Gitea database

The investigation therefore illustrates an important characteristic of n-day exploitation: once technical details and proof-of-concept code become public, attackers do not necessarily need to develop an exploit from scratch.

They can adapt existing research and rapidly build operational tooling around it.

Red Heron's targeting went beyond opportunistic scanning

The campaign was not limited to randomly selected Gitea installations.

Acronis found structured reconnaissance data in the exposed staging environment. Targets were classified using Simplified Chinese sector labels covering areas including:

• Defense and military

• Elections and voting

• Energy

• Aerospace

• Telecommunications

• Government

• Public safety

• Research

• Cloud and SaaS

• Developer tooling

• Gaming

• AI and machine learning

The researchers identified 128 systems with open registration that were filtered into a prioritized attack list.

The broader reconnaissance data included organizations in the United States, Canada, Taiwan and other countries.

Acronis also found evidence of successful compromises affecting organizations in Canada, Argentina, Taiwan, the United States and Sri Lanka.

The research does not establish that every scanned organization was successfully compromised.

This distinction is important because reconnaissance records, exploitation records and confirmed data theft represent different levels of evidence.

Source code theft was only the beginning

Once Red Heron obtained access to vulnerable Gitea installations, the activity moved beyond initial exploitation.

Acronis observed evidence of repository theft, credential collection, persistence and lateral movement.

The actor used hashcat against credentials stored in compromised Gitea databases. The tooling also included functionality to dump Gitea's filesystem data, including its database.

In one Taiwanese industrial automation environment, researchers found evidence that hundreds of repositories had been pulled.

The repositories reportedly included material associated with:

• Surveillance and monitoring

• SCADA/HMI technology

• IoT integrations

• Network sniffing

• Server configurations

• Internal business applications

A separate target contained data related to a learning management platform, AI chatbot, workflow automation tools and WordPress plugins.

This demonstrates why a source-code management platform can represent a much broader security risk than the repositories it directly hosts.

A compromised development platform can potentially expose credentials, deployment information, configuration data and connections to other infrastructure.

Persistence turned compromised servers into long-term footholds

Acronis found several mechanisms used to maintain access.

The campaign included SSH backdoors, raw TCP communication and other persistence techniques.

In one Canadian renewable-energy environment, researchers found multiple SSH key entries in authorized_keys, including entries associated with backdoor access.

The operator also launched a reverse shell and extracted configuration secrets, including JWT tokens, internal tokens and SSH host keys.

The investigation found evidence that the attacker mapped the internal Docker environment and gained visibility into the company's broader development infrastructure.

This represents a significant escalation from the original Gitea compromise.

The initial vulnerability provided access to the development platform. Post-exploitation activity then expanded that access into credentials, application infrastructure and internal networks.

A Gitea compromise reached a Proxmox cluster

One of the most significant examples of lateral movement occurred in a Taiwanese environment hosted on a Synology NAS.

Acronis says Red Heron obtained a Proxmox root authentication ticket and gained administrative access to the cluster management API.

The actor then:

1. Created storage for snippets on the cluster.

2. Uploaded payloads to three Proxmox nodes.

3. Initiated VM backup operations using vzdump.

4. Attempted to move beyond the original Gitea compromise.

The three nodes were identified as tapve01, tapve02 and tapve03.

This is significant because the potential impact had moved from source-code theft to the underlying virtualisation infrastructure.

A compromised development service can therefore become a pathway toward systems that host much broader portions of an organisation's environment.

Acronis describes this as the deepest lateral movement observed in the campaign.

JITTERLY: the Linux implant behind the operation

During threat hunting, Acronis identified a Linux ELF implant that it tracks as JITTERLY.

The malware is written in C++ and has characteristics that closely align with the Adaptix C2 framework and its Gopher protocol.

The implant can establish persistence, profile compromised hosts and communicate with its command-and-control infrastructure.

Acronis mapped more than 30 post-exploitation commands.

Its capabilities include:

• Command execution

• File upload and download

• File and directory manipulation

• Process termination

• System information collection

• Network interface enumeration

• Interactive terminal access

• SOCKS and TCP tunnelling

• Reverse port forwarding

• Network pivoting

• Port scanning

• Persistence management

• Environment enumeration

These capabilities make JITTERLY more than a simple command shell.

The implant can function as a post-compromise platform, allowing an operator to move through a compromised environment and interact with additional systems.

JITTERLY also carries the SIXZUT rootkit

The most notable discovery was inside JITTERLY itself.

Acronis found an encrypted payload embedded within the implant. After decrypting it, researchers identified a Linux shared library functioning as an LD_PRELOAD rootkit.

They named the rootkit SIXZUT.

The rootkit is designed to conceal activity from normal Linux user-space tools.

It can hide:

• Files

• Processes

• Network connections

• Rootkit-related artefacts

• The JITTERLY process itself

SIXZUT uses LD_PRELOAD to intercept selected libc functions before applications interact with the operating system.

This allows the malware to manipulate what legitimate programs see.

For example, if a security administrator uses a command that reads directory contents, SIXZUT can filter the returned results.

Similarly, the rootkit can interfere with visibility into /proc process information.

Network hiding extends beyond simple file filtering

SIXZUT's network concealment capabilities are particularly notable.

Acronis found that the rootkit can intercept information from several Linux networking visibility mechanisms.

It monitors access to files such as:

• /proc/net/tcp

• /proc/net/tcp6

• /proc/net/udp

• /proc/net/udp6

It can also handle applications that use lower-level socket interfaces.

The rootkit additionally monitors network diagnostic information obtained through Netlink.

This means that simply checking common user-space network tools may not provide a reliable picture of the compromised host.

Acronis therefore recommends investigating suspected systems using trusted or offline analysis methods rather than relying solely on tools running inside the potentially compromised environment.

The rootkit can protect the implant from termination

SIXZUT also interferes with attempts to terminate the JITTERLY process.

When an administrator attempts to send a signal to a hidden process, the rootkit can make the process appear nonexistent.

According to Acronis, this can cause an attempted process termination to fail because SIXZUT returns an error indicating that the process does not exist.

The rootkit can also relaunch the implant when it detects that the expected implant process or binary is missing.

This creates a defensive layer around the attacker-controlled implant.

The result is a compromise that is not simply persistent through a conventional startup mechanism. The rootkit actively attempts to maintain the implant's presence and conceal its activity.

Attribution remains an assessment, not a confirmed identity

Acronis assesses with moderate confidence that Red Heron represents a Chinese-speaking threat actor operating within a PRC-linked context.

The assessment is based on several observations, including:

• Simplified Chinese operational material

• PRC-style sector classifications

• The treatment of Taiwan within recovered operational metadata

• Targeting patterns

• Evidence suggesting possible external tasking

• The use of publicly available tools and frameworks

However, Acronis explicitly states that it has not identified sufficient evidence linking Red Heron to a previously tracked threat group.

That distinction matters.

The available evidence supports Acronis' assessment of the operational context, but it does not establish a definitive attribution to a known APT group.

Why this campaign matters

The Red Heron campaign highlights a broader security problem around self-hosted development platforms.

Development infrastructure is increasingly connected to the rest of an organisation's environment.

A repository platform can contain:

• Source code

• Credentials

• Access tokens

• Deployment keys

• Infrastructure configuration

• Internal application information

• Build and deployment relationships

A vulnerability in such a platform can therefore become an initial access point rather than an isolated application-level incident.

The campaign also demonstrates the shrinking gap between vulnerability disclosure and active exploitation.

CVE-2026-60004 was patched on July 27. A public advisory and proof of concept followed on July 28. According to Acronis, Red Heron began working with a public PoC on July 29 and had scanned 1,386 Gitea systems by July 30.

For defenders, this timeline reinforces the importance of treating newly disclosed vulnerabilities in internet-facing development infrastructure as potential exploitation opportunities rather than waiting for evidence of widespread attacks.

Mitigation and detection guidance

Acronis recommends several measures for organisations operating Gitea.

Upgrade Gitea

Organisations should upgrade affected installations to Gitea 1.27.1 or later.

Disable unnecessary registration

Open registration should be disabled where it is not required.

This does not fix the underlying vulnerability, but it can remove one part of the exploitation path described by Acronis.

Reduce internet exposure

Where practical, Gitea should not be directly exposed to the public internet.

A VPN or authenticated reverse proxy can provide an additional access-control layer.

Investigate newly created accounts

Security teams should review accounts and repositories created around the period following disclosure of CVE-2026-60004.

Unexpected temporary accounts may indicate automated exploitation activity.

Review logs

Teams should look for unexpected requests involving the Gitea diffpatch functionality and suspicious use of the metrics API.

Gitea processes spawning shells, interpreters or unexpected network utilities should also be investigated.

Check Linux persistence mechanisms

Acronis specifically recommends investigating:

• /etc/ld.so.preload

• libglthread.so.2

• .ld_aux_cahe

• /tmp/.X11-unix.lk

• Unexpected SSH keys

• Unfamiliar outbound connections

Because SIXZUT is designed to hide some of these artefacts from user-space tools, investigators should consider trusted kernels, offline images or EDR telemetry when analysing a suspected compromise.

Rotate exposed secrets

If a Gitea system has been compromised, organisations should assume that credentials, tokens and SSH keys stored on the system may have been exposed.

Those credentials should be rotated and their use reviewed.

Rebuild compromised systems

Acronis recommends rebuilding rather than relying on cleanup when compromise involving SIXZUT is confirmed.

The rootkit's persistence and concealment capabilities make removal from a running system unreliable.

The broader security lesson

Red Heron's campaign is a useful example of how a vulnerability in a developer-facing service can evolve into a broader infrastructure incident.

The initial weakness was in a source-code management platform.

The subsequent activity included repository theft, credential collection, persistence, internal reconnaissance, lateral movement and access to virtualisation infrastructure.

The discovery of JITTERLY and SIXZUT adds another layer to the campaign, showing that the attackers also had tooling designed for persistent Linux access and concealment.

For organisations operating self-hosted development platforms, the lesson is straightforward: source-code infrastructure should be treated as critical security infrastructure.

Rapid patching matters, but so do account controls, exposure reduction, credential rotation, logging and post-compromise investigation.

The campaign also highlights a broader industry shift toward highly automated exploitation of newly disclosed vulnerabilities. For defenders, the period immediately following public disclosure can be one of the most important windows for vulnerability response.