Red Heron

Red Heron is a Chinese-speaking threat actor known for multinational campaigns against internet-facing source-code management systems. Its targeting encompasses defense, elections, energy, aerospace, telecommunications, government, research, financial services, industrial automation, and information technology organizations. Confirmed compromises include organizations in Taiwan, the United States, Canada, Argentina, Qatar, and Sri Lanka. In July 2026, Red Heron rapidly operationalized public exploit code for CVE-2026-60004, a critical remote-code-execution vulnerability in Gitea. Its automated framework registered accounts, exploited vulnerable servers, downloaded repositories, and selectively removed database traces. The actor scanned 1,386 Gitea instances across seven countries and maintained a separate reconnaissance dataset covering 477 Taiwan-based systems. It also conducted a separate campaign targeting predominantly Joomla websites. Red Heron's intrusions combine source-code and database theft, credential collection, unauthorized SSH-key persistence, backdoor deployment, infrastructure discovery, and lateral movement. A Canadian renewable-energy company suffered theft of repositories, configuration secrets, internal tokens, and SSH material. In a Taiwanese environment, the actor pivoted from a compromised Gitea deployment to administrative access across a three-node Proxmox cluster and initiated virtual-machine backups. The actor's tooling includes JITTERLY, a C++ Linux implant supporting command execution, file transfers, interactive terminals, port scanning, network tunneling, and internal pivoting. JITTERLY uses encrypted raw-TCP command-and-control communications and incorporates SIXZUT, an LD_PRELOAD rootkit that conceals files, processes, and network connections, interferes with termination of protected processes, and can relaunch the implant. Red Heron also uses automated reconnaissance, password-hash cracking, and selective trace removal to support access and conceal its activity.