As reported by The Hacker News, a suspected Chinese-nexus threat actor designated Red Heron has weaponized CVE-2026-60004 — a critical remote code execution flaw in Gitea — to compromise at least 13 organizations across six countries within days of the vulnerability's July 2026 disclosure. The Acronis Threat Research Unit's findings paint a picture of a disciplined, well-resourced operator that automated the entire kill chain from scanning to persistence.
The Operational Tempo Problem
This campaign is a textbook case of how rapidly adversaries can operationalize N-day vulnerabilities. Red Heron didn't just run a public PoC — they built an automated Python framework that handles account registration, exploitation, repository exfiltration, and trace cleanup. The interval between public disclosure and weaponization has compressed to days, not weeks. Defenders who treat patching as a quarterly or even monthly cadence are operating on a timeline that no longer matches adversary capability.
The targeting profile is equally significant. Red Heron maintained a separate dataset of 477 Taiwan-based systems and used Simplified Chinese labels to categorize victims across defense, elections, energy, aerospace, telecom, and government — sectors aligning squarely with known Chinese intelligence collection priorities. The confirmed compromises span Canada, Argentina, Taiwan, the U.S., Qatar, and Sri Lanka, suggesting a broad non-discriminatory scan with selective deep-dive operations on high-value targets.
Vulnerability Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-60004 |
| Severity | Critical (RCE) |
| Affected Product | Gitea (self-hosted Git service), internet-facing instances |
| Vendor | Gitea Project |
| Patch Status | Patch available — consult Gitea security advisories |
| Active Exploitation | Yes — in the wild since July 29, 2026 |
| Exploitation Scope | 1,386 instances scanned across 7 countries; 13 confirmed compromises |
The Toolchain: JITTERLY + SIXZUT
What elevates this campaign beyond opportunistic scanning is the persistence tooling. Red Heron deployed JITTERLY, a C++ Linux implant supporting 30+ post-exploitation commands including shell execution, file transfer, network tunneling, and internal pivoting. JITTERLY shares code overlaps with the AdaptixC2 agent — a publicly available C2 framework — which means the barrier to entry for this class of tooling is lower than many defenders assume.
More concerning is SIXZUT, a previously undocumented LD_PRELOAD rootkit that patches 15 Linux functions to hide files, processes, and network connections. It includes a watchdog mechanism that relaunches the malware if terminated. This combination of stealth and resilience means that without specifically hunting for LD_PRELOAD manipulation, defenders may miss persistence entirely — especially on systems where standard EDR coverage is thin or absent, as is common with self-hosted development infrastructure.
The Proxmox cluster compromise — achieving root-level access across a three-node cluster — demonstrates that Red Heron wasn't just after source code. They were building durable footholds in virtualization infrastructure that could enable future operations far beyond the initial access point.
Shield53 Recommendations
/etc/ld.so.preload, environment variables, and shell profiles for suspicious LD_PRELOAD entries. SIXZUT patches 15 functions; look for anomalies in readdir, readlink, fopen, and network enumeration calls.Red Heron's campaign underscores a persistent reality: self-hosted development infrastructure remains a high-value, under-defended target. The speed from disclosure to weaponization is no longer the story — the story is whether your patching and exposure management can keep pace.
