Two Days After a Patch, Red Heron Scanned 1,386 Gitea Servers

A Chinese-speaking hacking group scanned 1,386 internet-facing Gitea servers across seven countries within two days of a fix shipping for a critical remote-code-execution flaw, and went on to compromise at least 11 organizations, Acronis's Threat Research Unit said Sept. 13. The unit tracks the group as Red Heron.

Gitea, a self-hosted alternative to GitHub, patched the flaw, tracked as CVE-2026-60004 and rated 9.8 out of 10 on the CVSS severity scale, in version 1.27.1 on July 27. The bug lets an attacker abuse Git's three-way merge inside Gitea's diffpatch feature to write malicious files directly into a repository's hook scripts, according to Cyber Security News, which reviewed the same campaign. Those hooks then run with the privileges of the Gitea process itself.

How fast CVE-2026-60004 went from patch to exploitation

Acronis researcher Subhajeet Singha wrote that Red Heron converted public proof-of-concept code into an automated framework within two days of the advisory. Weaponization began July 29, large-scale scanning was complete by July 30, and Acronis found the group's staging server on Aug. 4, a week after the patch shipped.

Metric	Count
Gitea versions affected	1.17 through 1.27.0
Instances scanned	1,386
Countries scanned	7
Taiwan-focused targets	477
Confirmed compromised organizations	11

What Red Heron leaves behind

The group's implant, JITTERLY, is written in C++, supports more than 30 post-exploitation commands and encrypts its traffic with AES-128-GCM, according to Acronis. It pairs with a separate rootkit called SIXZUT, which loads via Linux's LD_PRELOAD mechanism and hooks 15 library functions to hide its own files, processes and network connections, and to relaunch itself if a defender kills it.

Where the campaign actually landed

Acronis confirmed victims in Canada, Argentina, Taiwan, the United States and Sri Lanka. A Canadian renewable-energy company suffered the most extensive compromise the researchers documented, with the group reaching its source code, HR and CRM systems, authentication services and Docker infrastructure. A separate Taiwan-based victim's compromised Synology NAS gave Red Heron administrative access to a Proxmox virtualization cluster.

Acronis assigns the Taiwan-heavy targeting, the group's use of Simplified Chinese in its operational material, and its classification of Taiwan as domestic territory to "moderate confidence" that Red Heron operates within a PRC-linked context. That is a lower bar than attribution to a specific government unit, and Acronis does not claim more than that.

The speed of the Gitea campaign echoes the automated re-infection pattern in npm's own Shai-Hulud worm, though Red Heron's tooling targets self-hosted git infrastructure rather than package registries. It also fits the pattern behind Cisco's own September disclosures: once a serious n-day flaw is public, named groups now weaponize it in days, not weeks.

Gitea has not published an updated advisory since July 28, and Acronis has not said whether it notified all 11 confirmed victims directly or through national computer emergency response teams.