Summary Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management platform. The activity progressed from source-code theft to persistent access, credential collection, and lateral movement, including root-level access to a three-node Proxmox cluster. TRU traced a Linux implant to Red Heron’s exposed staging server, revealing the actor’s exploitation tools, reconnaissance databases, command history, stolen repositories, and malware. This provided rare visibility into the operation, from target selection and vulnerability weaponization to post-exploitation activity. Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems. Targets were classified using Simplified Chinese labels covering defense, elections, energy, aerospace, telecommunications, government, and research. Confirmed compromises affected organizations in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Within days of the vulnerability’s July 2026 disclosure, Red Heron transformed public proof-of-concept code into an automated framework capable of registering accounts, exploiting vulnerable servers, stealing repositories, and removing selected traces. The campaign demonstrates how quickly n-day vulnerabilities in self-hosted development platforms can expose source code, credentials, secrets, and connected infrastructure. The staging server also contained JITTERLY, a C++ Linux implant supporting more than 30 post-exploitation commands, including shell execution, file transfer, network tunneling, interactive terminal access, and internal pivoting. Embedded inside it was SIXZUT, a previously undocumented LD_PRELOAD rootkit capable of hiding files, processes, and network connections, preventing the implant from being terminated, and relaunching it if the process is stopped while the binary remains present. TRU assesses with moderate confidence that Red Heron operates within a PRC-linked context, based on Simplified Chinese operational material, its classification of Taiwan as part of China, and targeting aligned with apparent strategic collection priorities. We have not identified sufficient evidence linking Red Heron to a previously tracked threat group. Introduction During routine threat hunting, Acronis Threat Research Unit (TRU) identified a Linux implant, which we track as JITTERLY, and traced it to an exposed staging server operated by a threat actor we track as Red Heron. Discovered on August 4, the server contained exploitation tools, targeting data, command history, stolen repositories, and malware, providing rare visibility into the actor’s operations. A related JITTERLY sample had previously been publicly analyzed and linked to Adaptix C2 , an open-source framework used to control compromised systems during post-exploitation operations. TRU’s investigation connects the implant to Red Heron and reveals that it contains an embedded Linux rootkit, which we track as SIXZUT. The rootkit can conceal files, processes, and network connections, protect JITTERLY from termination, and relaunch it if it is stopped or removed. We identified no previous public reporting on SIXZUT. Red Heron weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public proof-of-concept code appearing on GitHub. The actor developed it into an automated framework capable of registering accounts, exploiting vulnerable servers, stealing repositories, and removing selected traces. Red Heron scanned 1,386 Gitea instances across seven countries and maintained structured target databases using Simplified Chinese classifications covering defense, elections, energy, aerospace, telecommunications, government, and research. Recovered records documented successful compromises in Canada, Argentina, Taiwan, the United States, and Sri Lanka. Observed activity included source-code theft, credential collection, SSH persistence, backdoor deployment, and lateral movement. In one Taiwanese environment, the actor progressed from a vulnerable Gitea server to root-level administrative access across a three-node Proxmox cluster. The same infrastructure was also associated with a separate campaign targeting 18 predominantly Joomla-based websites across 10 countries. TRU assesses with moderate confidence that Red Heron operates within a PRC-linked context, based on its Simplified Chinese operational material, targeting taxonomy, treatment of Taiwan as part of China, and apparent collection priorities. This research examines the campaign’s rapid n-day weaponization, victim compromises, operator tradecraft, JITTERLY and SIXZUT, and the evidence supporting our assessment. Anatomy of CVE-2026-60004: exploiting Gitea’s patch workflow CVE-2026-60004 is a critical remote code execution vulnera...