Security researchers at Acronis have caught a Chinese-speaking hacking group actively exploiting a critical remote-code-execution flaw in Gitea, the popular self-hosted alternative to GitHub, to break into source-code repositories, steal credentials, and plant backdoors across five countries. The group, tracked as Red Heron, moved quickly to weaponize the bug after a public proof-of-concept surfaced, turning what began as a routine patch advisory into an active, multi-continent intrusion campaign.

Inside the Vulnerability

The flaw, catalogued as CVE-2026-60004 and rated 9.8 out of 10 on the CVSS scale, lives in Gitea’s diffpatch functionality and affects every release between version 1.17 and 1.27.0. The bug abuses Git’s own three-way merge logic: by submitting a specially crafted patch, an attacker can trick the merge process into writing a malicious file directly into a repository’s hook directory. Because Git hooks execute automatically during routine index operations, that planted file runs with the permissions of the Gitea service account itself, handing the attacker code execution on the underlying server.

Critically, exploitation does not require stolen credentials. Any Gitea instance that still allows open user self-registration can be compromised by simply signing up for a free account, creating a repository, and submitting the crafted patch. Gitea shipped a fix in version 1.27.1 back in July, but a large population of internet-facing servers has yet to apply it.

A Fast-Moving Global Scanning Campaign

According to Acronis’s Threat Research Unit, Red Heron wasted little time turning the disclosure into a weapon. The group ran automated scans against 1,386 internet-exposed Gitea servers spread across seven countries, while separately maintaining a target list of 477 specifically Taiwan-based instances — a detail researchers say points to a degree of pre-existing interest in Taiwanese infrastructure rather than purely opportunistic scanning.

Once inside a vulnerable instance, the attackers followed a consistent playbook: register an account, open or create a repository, trigger the diffpatch flaw, and use the resulting shell access to harvest secrets, steal source code, and install persistence mechanisms. Confirmed victims span a renewable energy company in Canada, organizations in Argentina, Taiwan, the United States, and Sri Lanka.

Custom Malware and Deep Post-Exploitation

Red Heron’s toolkit includes a purpose-built Linux implant that researchers have named JITTERLY, which communicates with its command-and-control infrastructure over encrypted TCP connections to evade network monitoring. Alongside it, the group deploys a kernel-level rootkit dubbed SIXZUT that uses the LD_PRELOAD technique to hide its presence from standard system utilities.

The intrusion at the Canadian renewable energy firm illustrates how far the group is willing to go once inside a network. Investigators found the attackers had accessed internal applications, HR and CRM platforms, authentication services, and business-facing APIs, pulled information about the company’s Docker network configuration, planted SSH keys for persistent access, and systematically collected configuration secrets. In a separate incident at a Taiwanese organization running Synology NAS infrastructure, the attackers escalated from their initial Gitea foothold to obtain Proxmox root authentication tickets, ultimately gaining administrative control of a three-node Proxmox virtualization cluster and uploading payloads through the platform’s own VM backup functionality.

What Defenders Should Do Now

Acronis and Gitea’s maintainers are urging administrators to treat this as an emergency patching priority. Recommended steps include:

• Upgrade every Gitea instance to version 1.27.1 or later without delay
• Disable open user self-registration unless it is strictly required
• Restrict internet-facing access to Gitea instances behind a VPN or allow-list where possible
• Audit recently created accounts and repositories for suspicious activity
• Review server logs for unexpected requests to the diffpatch endpoint
• Rotate all tokens, passwords, SSH keys, and other secrets that may have been exposed, and treat affected source code as potentially compromised

Because the exploit chain requires no prior credential theft, any exposed and unpatched Gitea deployment should be considered at risk regardless of its perceived value as a target — a lesson Red Heron’s broad, opportunistic scanning has already driven home for organizations that never expected to be on a nation-state actor’s radar.