Critical Gitea Remote Code Execution Flaw Hits 13 Organizations

A critical remote code execution vulnerability in Gitea, a self-hosted service for storing and sharing source code, has been exploited to compromise 13 organizations across six countries, according to an analysis by Acronis Threat Research Unit (TRU). The suspected Chinese threat actor tracked as Red Heron weaponized CVE-2026-60004, turning publicly available exploit code into an automated Python framework only days after the flaw was disclosed in July 2026.

Acronis TRU reported that Red Heron scanned 1,386 Gitea instances across seven countries and kept a separate list of 477 Taiwan-based systems. The campaign moved from stealing source code to establishing persistent access, collecting credentials, and moving laterally across compromised networks. In one case, the actor gained root-level administrative access to a three-node Proxmox cluster, a set of servers managed together with Proxmox virtualization software. The confirmed victims include organizations in Canada (2), Argentina (1), Taiwan (4), the United States (4), Qatar (1), and Sri Lanka (1). The attackers used Simplified Chinese labels to sort targets in sectors including defense, election, energy, aerospace, telecommunications, government, public safety, and research. Acronis said it has moderate confidence that Red Heron operates in a China-linked context because of the Simplified Chinese text, the cluster's consistent classification of Taiwan as part of China, and a targeting footprint that aligns with China's intelligence collection priorities.

On a staging server attributed to the adversary, researchers found a C++ Linux implant called JITTERLY. This backdoor supports more than 30 post-exploitation commands for shell execution, file transfer, process termination, network tunneling, interactive terminal access, and internal pivoting, which means moving from one compromised machine to another within a network. JITTERLY was previously documented by a researcher using the online alias "dmpdump" in July 2026, who described overlaps with the AdaptixC2 agent. The backdoor also contains a previously undocumented LD_PRELOAD rootkit named SIXZUT. LD_PRELOAD is a Linux feature that lets programs load extra code at startup, and the rootkit uses it to patch 15 different Linux functions so it can hide files, processes, and network connections, prevent the malware from being detected or killed, and relaunch itself if it is terminated or removed.

The exploitation began on July 29, 2026, when Red Heron transformed a public proof-of-concept into an automated Python framework called "exp_enhanced.py." Security researcher Subhajeet Singha said the framework was capable of registering accounts, exploiting vulnerable servers, stealing repositories, and removing selected traces. "Within days of the vulnerability's July 2026 disclosure, Red Heron transformed public proof-of-concept code into an automated framework capable of registering accounts, exploiting vulnerable servers, stealing repositories, and removing selected traces," Singha said. "The campaign demonstrates how quickly N-day vulnerabilities in self-hosted development platforms can expose source code, credentials, secrets, and connected infrastructure." An N-day vulnerability is a publicly known flaw for which a patch may exist but has not yet been applied everywhere.

Further review of the staging server showed more of the actor's methods. The same infrastructure was used to target 18 Joomla-based websites across 10 countries with a Python script called "exp.py" before the Gitea exploit was cloned. Those targets included an overseas education consulting firm based in India and a U.S.-based IT managed service provider. The actor also carried out extensive reconnaissance of an Argentine quantitative trading firm. From a Taiwanese industrial automation company, the attackers exfiltrated hundreds of repositories related to a SCADA/HMI tool, which is software used to control and monitor industrial equipment, plus IoT platform integrations, a network sniffer, server configurations, surveillance and monitoring products, and internal business applications. From a Qatar-based target, they stole data that included a learning management platform, an artificial intelligence chatbot, workflow automation tools, and WordPress plugins. At a Canadian renewable energy company, the actor mapped the infrastructure and exfiltrated repositories, configuration secrets, internal tokens, SSH host keys, and internal applications.

"By combining automated Gitea exploitation with structured target selection, the actor progressed from repository theft to credential collection, persistent access, and lateral movement across victim environments," Singha said. "Its focus on organizations associated with elections, defense, energy, government, and research suggests deliberate collection priorities alongside broader opportunistic scanning." For teams that self-host development platforms or any internet-facing service, the incident is a reminder that a single unpatched web application can expose source code, credentials, and the wider network. Organizations that run self-hosted tools can reduce their exposure through security-first IT and infrastructure consulting such as AEU-I, which helps teams assess and harden their deployments before an attacker finds the same gap.