Suspected China-aligned threat group Red Heron has actively exploited CVE-2026-60004 (CVSS 9.8), a critical remote code execution flaw in self-hosted Gitea servers. The vulnerability allows adversaries to inject malicious Git hooks that execute arbitrary commands under the Gitea service context during repository actions. Telemetry from the Acronis Threat Research Unit identified an automated Python framework (exp_enhanced.py) scanning 1,386 internet-facing Gitea instances across seven countries, heavily prioritizing targets in Taiwan and North America.

Red Heron compromised at least 13 organizations across defense, aerospace, and government sectors, exfiltrating proprietary source code and pivoting laterally to obtain root control over Proxmox hypervisors. Post-exploitation toolsets included JITTERLY, a 30-command C++ Linux implant, and SIXZUT, an undocumented LD_PRELOAD rootkit. SIXZUT intercepts 15 libc system calls to mask attacker processes, files, and socket connections from forensic tools while executing watchdog routines to guarantee persistence.

Why it matters:

• Subversion of source-control boundaries: RCE via Git hooks compromises the developer trust perimeter, giving attackers unconstrained access to proprietary codebases while LD_PRELOAD rootkits bypass host-level integrity checks by subverting standard system inspection utilities.
• Aggressive perimeter patching and hypervisor isolation: Defenders must immediately upgrade Gitea instances to patched releases, isolate developer repositories behind authenticated reverse proxies, and audit hypervisor control planes (such as Proxmox) for unauthorized administrative credential reuse.