Loading story…
China-linked threat actor Red Heron exploited CVE-2026-60004, a critical remote-code-execution vulnerability in Gitea, to compromise 13 organizations in Canada, Argentina, Taiwan, the United States, Qatar, and Sri Lanka. After the flaw’s public disclosure, the operator scanned 1,386 Gitea servers across seven countries and separately tracked 477 systems in Taiwan, targeting organizations in defense, elections, energy, aerospace, telecommunications, government, public safety, and research.
Red Heron integrated public proof-of-concept code into a Python automation framework that created accounts, exploited exposed servers, exfiltrated repositories, and selectively removed evidence. The intrusions stole source code, credentials, secrets, tokens, SSH keys, and internal applications; in one Taiwanese victim, the actor moved laterally to root-level access across a three-node Proxmox cluster. The group maintained access with the JITTERLY Linux implant and its embedded SIXZUT LD_PRELOAD rootkit, enabling covert persistence, post-exploitation activity, and evasion.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
Red Heron began using the Python framework exp_enhanced.py, which automated account registration, exploitation of vulnerable Gitea servers, repository theft, and selected trace removal.
CVE-2026-60004, a critical remote-code-execution vulnerability affecting Gitea, was disclosed in July 2026.
In a Taiwanese victim environment, Red Heron pivoted from a compromised Gitea server to root-level administrative access across a three-node Proxmox cluster.
Red Heron deployed the C++ Linux implant JITTERLY, which supports more than 30 post-exploitation capabilities and contains the undocumented SIXZUT LD_PRELOAD rootkit for hiding files, processes, and network connections and resisting removal.
The actor exfiltrated source repositories and sensitive materials including configuration secrets, internal tokens, SSH keys, and internal applications from victims including Taiwanese industrial automation, Qatari, and Canadian renewable-energy organizations.
Red Heron's Gitea campaign compromised two organizations in Canada; one each in Argentina, Qatar, and Sri Lanka; and four each in Taiwan and the United States. Targeted sectors included defense, elections, energy, aerospace, telecommunications, government, public safety, and research.
The actor scanned 1,386 internet-facing Gitea instances across seven countries and maintained a separate dataset covering 477 systems in Taiwan.
Before adopting the Gitea exploit, Red Heron used the same infrastructure and a Python script named exp.py to target 18 Joomla websites, including an India-based education consulting firm and a U.S.-based managed service provider.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2026-60004** to its Known Exploited Vulnerabilities catalog after confirming exploitation of a code-injection flaw in the Gitea self-hosted development platform. An attacker with repository write access can send a malicious patch to the `diffpatch` API, install an executable Git hook, and run shell commands under the Gitea service account. Gitea addressed the vulnerability in version **1.27.1**; CISA set an August 28 remediation deadline for U.S. federal agencies and advised affected organizations to apply vendor mitigations, assess internet exposure, and conduct relevant forensic triage. The responsible threat actors and their objectives remain unknown. CISA's preceding catalog update also added **CVE-2026-21962**, an improper access-control vulnerability in Oracle HTTP Server and the Oracle WebLogic Server Proxy Plug-in. The Oracle flaw can permit unauthorized creation, deletion, modification, or access to critical data, potentially extending to all accessible product data. Organizations should prioritize patching or applying vendor mitigations for both KEV-listed vulnerabilities, and discontinue affected products where mitigations are unavailable.
Aug 28, 2026
Cisco Talos reported that Chinese-speaking threat actor **UAT-10147** targeted vulnerable internet-facing **Windows IIS** and **Linux** servers worldwide, using publicly disclosed one-day flaws to gain access and then deploying a broad post-compromise toolkit tied to **SEO fraud** and data theft. Talos said the group used AI-assisted workflows to automate reconnaissance, exploit validation, payload deployment, persistence, and operational documentation, and maintained infrastructure suggesting significant scale, including a target list of roughly **170,000 URLs**. On compromised Windows systems, the actor used batch scripts, scheduled tasks, rogue user creation, **EfsPotato**, and Defender exclusions; on Linux, it relied on web shells and local privilege-escalation exploits to obtain root access. A central payload in the campaign was **SPECTRE**, a custom cross-platform backdoor for Windows and Linux that supports HTTP-based command and control, anti-analysis, process injection, credential access, and on Windows a **BYOVD** technique to reduce EDR visibility by unlinking kernel callbacks. On Linux, SPECTRE deployed a rootkit called **Specter**, disguised as `acpi_pad.ko` and persisted through a fraudulent systemd service to hide processes and modules and elevate privileges. Talos also observed **Noodle RAT**, **QuasarRAT**, **Gh0stCringe**, **Meterpreter**, and web shells in the same operations; prior research has linked Noodle RAT variants to multiple Chinese-speaking espionage and financially motivated clusters, including Linux samples that copy themselves to `/tmp/CCCCCCCC`, decrypt configuration with RC4 using the hardcoded key `r0st@#$`, and connect to attacker-controlled C2 servers.
Aug 28, 2026
Researchers at Solar 4RAYS uncovered a long-running cyber-espionage campaign targeting at least four companies that provide services to Russian government organizations, identifying a previously unseen Golang backdoor dubbed **GoblinRAT**. The intrusions reportedly ran from at least October 2020 through 2023 and relied on highly stealthy, hands-on-keyboard activity on Linux systems. Investigators said the operators abused built-in Linux utilities, used unique persistence names on each host, masqueraded malicious processes as legitimate services such as **Zabbix**, **memcached**, `vmtoolsd`, `cron`, and Red Hat subscription components, and in some cases executed malware only in memory. The malware was also hidden as a malicious library loaded into `atop`, while command-and-control infrastructure used compromised legitimate websites and DDNS services.
Aug 15, 2026