Researchers from Acronis Threat Research Unit (TRU) detailed how a Chinese-speaking threat actor tracked as Red Heron exploited the critical CVE-2026-60004 remote code execution flaw in internet-facing Gitea instances within days of public proof-of-concept code appearing. The campaign scanned 1,386 Gitea instances across seven countries and maintained a separate database of 477 Taiwan-based systems, with targets classified across defense, elections, energy, aerospace, telecommunications, government and research.
Acronis confirmed that the compromises affected organizations in Canada, Argentina, Taiwan, the U.S. and Sri Lanka, with activity including source-code theft, credential collection, persistence and lateral movement. The campaign also exposed a previously undocumented Linux rootkit that Acronis tracks as SIXZUT, embedded in the JITTERLY implant used by Red Heron. The implant supports more than 30 post-exploitation commands, including shell execution, file transfer, network tunneling and internal pivoting, while SIXZUT can hide files, processes and network connections, protect the implant from termination and relaunch it if stopped.
Acronis said the hackers used an automated exploitation framework to register accounts, compromise vulnerable Gitea servers, steal repositories and remove selected traces, including pulling hundreds of repositories from a Taiwanese industrial automation company containing surveillance and monitoring software, a SCADA/HMI tool, IoT platform integrations and network-sniffing software.
The post attributed the campaign with moderate confidence to Red Heron, a PRC-linked Chinese-speaking threat actor, based on Chinese-language artifacts, targeting methodology, victimology, and observed tradecraft. Reconnaissance databases, target classifications and FOFA scan metadata recovered from the staging server were written entirely in Simplified Chinese. Classifications included defense and military, election and voting systems, energy, and aerospace. Acronis also found that Taiwan was consistently identified as country ‘CN’ and region ‘TW,’ treating it as a region of China rather than a separate country.
A Taiwan-specific target list containing 477 Gitea instances included the metadata field ‘source: Given authorized website,’ suggesting the list was supplied externally. An exec[dot]sh script that transferred stolen data from the staging server over HTTP using another machine also indicated a possible team-based operation rather than a lone actor, Acronis said. Red Heron relied on publicly available and open-source tools, including a forked GitHub proof of concept for CVE-2026-60004, the Adaptix command-and-control framework used with the JITTERLY implant, and FOFA for reconnaissance.
Based on data retrieved from the threat actor’s arsenal, Acronis identified 11 confirmed targets across five countries. The original target names were redacted for multiple reasons.
These targets included a renewable energy company in Canada, with 22 sessions, and an election-titled Gitea instance in the U.S., with 14 sessions. In Taiwan, the list included a code developer with seven sessions, a hotel-related target with six sessions, an industrial automation target involving a Synology NAS with two sessions, and an industrial automation company with one session.
The U.S. targets also included two municipal platforms, each with two sessions, and a media and creative studio with one session. In Argentina, a quantitative trading firm accounted for two sessions. The list also included an education platform using Forgejo in Canada, with one session, and an IT consultancy in Sri Lanka, with one session. In total, the data identified 11 targets across five countries: Canada, the U.S., Taiwan, Argentina and Sri Lanka.
“Apart from the compromise of the Argentine trading firm, we also found that Red Heron had successfully pulled source code from multiple other victims,” the post detailed. “We found that the exfiltrated data from the Taiwanese manufacturing company was by far the largest. Upon investigation, we identified this target as a Taiwanese industrial automation company. The operator pulled hundreds of repositories from this single host; we found repositories for what appears to be their surveillance and monitoring product, a SCADA/HMI tool used in industrial control environments, IoT platform integrations, a network sniffer, server configurations, and internal business applications.”
Acronis also counted over 130 leftover poc-* directories from this host alone, which are repos the exploit auto-creates each time it runs, and since the cleanup clearly did not work here, it gives us a rough count of how many times Red Heron ran the chain against this target. A Qatar-based target also had data successfully pulled, including a learning management platform, an AI chatbot, workflow automation tools, and WordPress plugins. The remaining three targets from the batch run had exploit artifacts present but no actual repository data, likely due to connection timeouts.
The researchers also saw Red Heron move deeper into a Canadian company operating in the renewable energy space. Out of all the targets in this campaign, this one was by far the most extensively compromised, with 22 separate exploitation sessions documented in the poc-results.
“The operator did not just steal repositories here,” they added. “They mapped the entire infrastructure, identified a legitimate employee’s account, and pulled down the company’s full application stack, including their HR system, CRM, authentication service, company intranet, internal reports, and business APIs. Configuration secrets, including JWT tokens, internal tokens, and SSH host keys, were extracted from the Gitea configuration. A deploy key tied to the company’s HCM staging environment was also exposed.”
In targeting Taiwanese organizations, Red Heron registered a deliberately named account, demonstrating tactical planning and adaptation after an earlier failed attempt.
In conclusion, Acronis identified that Red Heron demonstrates how quickly threat actors can turn public proof-of-concept code into a scalable n-day exploitation campaign. By combining automated Gitea exploitation with structured target selection, the actor progressed from repository theft to credential collection, persistent access, and lateral movement across victim environments. Its focus on organizations associated with elections, defense, energy, government, and research suggests deliberate collection priorities alongside broader opportunistic scanning.
“The exposed staging server provided rare visibility into the operation, including its exploitation framework, reconnaissance data, stolen repositories, and post-exploitation tooling,” the post added. “It also connected Red Heron to JITTERLY and its embedded SIXZUT rootkit, revealing capabilities designed to support covert, persistent access to Linux systems.”
It added that the campaign highlights that internet-facing development platforms can provide access not only to source code, but also to credentials, application secrets, deployment infrastructure, and connected systems. Rapid patching, restricted account registration, and close monitoring of self-hosted development environments are therefore essential to preventing an initial repository-server compromise from becoming a broader infrastructure breach.
