Cybersecurity researchers at **Acronis Threat Research Unit (TRU)** have attributed a sophisticated cyber espionage campaign to a group identified as **Red Heron**, suspected of operating from China. This group rapidly exploited a recently disclosed security vulnerability in **Gitea**, a self-hosted Git service, to compromise systems globally. ## Targeted Exploitation and Global Reach **Red Heron** systematically scanned 1,386 **Gitea** instances across seven countries, maintaining a distinct dataset of 477 Taiwan-based systems. The campaign's activities escalated from initial source-code theft to establishing persistent access, collecting credentials, and executing lateral movement, ultimately achieving root-level access to a three-node **Proxmox** cluster in one instance. Confirmed compromises have been reported in organizations across Canada (2), Argentina (1), Taiwan (4), the U.S. (4), Qatar (1), and Sri Lanka (1). The threat actor used Simplified Chinese labels to classify targets, which span critical sectors including defense, elections, energy, aerospace, telecommunications, government, public safety, and research. **Acronis** assessed with moderate confidence that **Red Heron** operates within a China-linked context. This assessment is based on the use of Simplified Chinese, the consistent classification of Taiwan as part of China in their targeting, and a targeting footprint that aligns with China's intelligence collection priorities. ## Advanced Malware Arsenal: JITTERLY and SIXZUT Analysis of a staging server linked to **Red Heron** revealed a potent C++ Linux implant dubbed **JITTERLY**. This backdoor supports over 30 post-exploitation commands, facilitating shell execution, file transfers, process termination, network tunneling, interactive terminal access, and internal pivoting. **JITTERLY** was previously documented by a researcher under the alias "dmpdump" in July 2026, noting its overlaps with the **AdaptixC2** agent. Within **JITTERLY**, researchers discovered a previously undocumented **LD_PRELOAD** rootkit named **SIXZUT**. This rootkit is designed to hide files, processes, and network connections by patching 15 different Linux functions. Its capabilities allow **Red Heron** to obscure malicious activity, prevent detection and termination of the malware, and ensure its relaunch if removed.  ## Rapid Exploitation of CVE-2026-60004 **Red Heron** weaponized **CVE-2026-60004**, a critical **Gitea** remote code execution vulnerability. Within days of its disclosure in July 2026, the threat actor transformed a publicly available exploit (**HORKimhab/CVE-2026-60004**) into a fully automated Python framework, "exp_enhanced.py." This framework enabled automated account registration, server exploitation, repository theft, and the removal of traces. According to security researcher Subhajeet Singha, "The campaign demonstrates how quickly N-day vulnerabilities in self-hosted development platforms can expose source code, credentials, secrets, and connected infrastructure." ## Attacker Tradecraft and Specific Targets Further examination of the staging server provided insight into **Red Heron's** tradecraft: * **Joomla Exploitation:** The same infrastructure was used to target 18 **Joomla**-based websites across 10 countries with a Python script ("exp.py") before the **CVE-2026-60004** exploit was cloned. Targets included an Indian overseas education consulting firm and a U.S.-based IT managed service provider. * **Extensive Enumeration:** The group conducted comprehensive enumeration of an Argentine quantitative trading firm. * **Data Exfiltration:** Data was exfiltrated from a Taiwanese industrial automation company, including hundreds of repositories related to a **SCADA/HMI** tool, **IoT** platform integrations, a network sniffer, server configurations, a surveillance and monitoring product, and internal business applications. * **Qatar Target:** Data exfiltration from a Qatar-based target included a learning management platform, an artificial intelligence (**AI**) chatbot, workflow automation tools, and **WordPress** plugins. * **Canadian Infrastructure Mapping:** Extensive infrastructure mapping of a Canadian renewable energy company led to the exfiltration of repositories, configuration secrets, internal tokens, **SSH** host keys, and internal applications. Singha concluded, "By combining automated **Gitea** exploitation with structured target selection, the actor progressed from repository theft to credential collection, persistent access, and lateral movement across victim environments. Its focus on organizations associated with elections, defense, energy, government, and research suggests deliberate collection priorities alongside broader opportunistic scanning."