The critical CVE-2026-60004 vulnerability in the Gitea platform (CVSS 9.8), which we have already covered, has become the vector for a large-scale cyber-espionage campaign. According to a report by the Acronis Threat Research Unit (TRU), a group tracked as Red Heron turned the publicly released exploit into an automated attack tool within days of its publication and reportedly compromised 13 organizations across six countries — Canada, Argentina, Taiwan, the United States, Qatar, and Sri Lanka. All administrators of Gitea instances running versions from 1.17 through 1.27.0 inclusive must urgently update to version 1.27.1 or later.
Technical essence of the vulnerability
According to the official Gitea advisory, the CVE-2026-60004 (CWE-94) vulnerability is tied to the diffpatch endpoint: an attacker with write permissions to a repository can use a specially crafted patch to install and execute a malicious Git hook, gaining the ability to run arbitrary commands as the Gitea system user.
An important nuance that is often overlooked in descriptions of this vulnerability: it is not inherently pre-authentication. Exploitation requires write access to a repository. However, because Gitea enables open registration by default, an attacker can create their own account and repository, effectively bypassing this limitation without needing to steal anyone’s credentials. In addition, according to the advisory, exploitation requires Git version 2.32 or newer, the diffpatch route to be enabled, and a writable/executable temporary file system.
The vulnerability affects all Gitea versions starting from 1.17 up to but not including 1.27.1. The patch was released on July 27, 2026. In late August, CISA added CVE-2026-60004 to the Known Exploited Vulnerabilities (KEV) catalog, setting an August 28, 2026, deadline for federal agencies. Nevertheless, according to Shadowserver Foundation, at the time of scanning there were still more than 8,300 vulnerable IP addresses, mainly in China, Germany, and the United States.
Red Heron campaign: timeline and scale
According to the Acronis TRU report, the Red Heron group began weaponizing the publicly available exploit for CVE-2026-60004 on July 29, 2026 — just two days after the patch was released. The public PoC code was reworked into an automated Python framework (exp_enhanced.py) capable of registering accounts, exploiting vulnerable servers, stealing repositories, and wiping traces.
The same report states that Red Heron scanned 1,386 Gitea instances in seven countries and maintained a separate inventory of 477 systems in Taiwan. Reportedly, confirmed compromises affected organizations in the defense, energy, aerospace, telecommunications, government, and research sectors.
Among the incidents documented in the report:
- Intrusion into a Taiwanese environment where the attackers moved from a vulnerable Gitea server to root access on a three-node Proxmox cluster
- Exfiltration of hundreds of repositories from a Taiwanese industrial automation company, including code for SCADA/HMI tools, IoT integrations, and monitoring systems
- Theft of repositories, configuration secrets, SSH keys, and internal tokens from a Canadian renewable energy company
- Attacks against 18 Joomla-based websites in 10 countries using the same infrastructure
It should be noted that the campaign details listed are based on a single source — the Acronis TRU report — and have not been independently confirmed by other researchers.
Tooling: JITTERLY and SIXZUT
According to the report, a C++ Linux implant called JITTERLY was found on an attacker staging server. It supports more than 30 post-exploitation commands: executing shell commands, transferring files, terminating processes, network tunneling, interactive terminal access, and lateral movement. This implant was previously described by a researcher using the alias dmpdump, who noted its similarity to the AdaptixC2 agent documented by Unit 42.
Inside the backdoor, researchers found a previously undocumented LD_PRELOAD-based rootkit called SIXZUT. According to the report, it intercepts 15 different Linux functions to hide files, processes, and network connections, and can automatically restart if terminated or deleted.
Attribution
Acronis assesses a connection between Red Heron and China with moderate confidence. The basis for this assessment includes: the use of Simplified Chinese for labeling target categories, consistent classification of Taiwan as part of China, and a target profile that aligns with the intelligence-gathering priorities of the PRC. There is currently no independent confirmation of this attribution from other research teams.
Recommendations for defense
- Update Gitea to version 1.27.1 or later. This fixes CVE-2026-60004
- Disable open registration if it is not required for operations — this is a key condition that allows the vulnerability to be exploited without prior access
- Review logs for suspicious account registrations, repository creation, and requests to the
diffpatchendpoint during the vulnerable period - Audit Git hooks in existing repositories for unauthorized changes
- Restrict network access to Gitea instances — placing them behind a VPN or restricting by IP significantly reduces the attack surface
- Check the temporary file system: if it is mounted with the
noexecflag, exploitation via this vector is impossible
The Red Heron campaign clearly demonstrates how quickly public exploits for vulnerabilities in development platforms are turned into tools of targeted espionage. Based on available data, only two days passed between the release of Gitea 1.27.1 and the start of automated attacks. Organizations running self-hosted Gitea instances must not only apply the update, but also conduct a retrospective compromise assessment — especially if the instance was exposed to the internet with open registration enabled during the pre-patch period. You can read more about the vulnerability itself and the exploitation mechanism via Git hooks in our previous analysis.
