acronis.comPublished
Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit
By SubhajeetSingha
Excerpt
Summary
Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management platform. The activity progressed from source-code theft to persistent access, credential collection, and lateral movement, including root-level access to a three-node Proxmox cluster.
TRU traced a Linux implant to Red Heron’s expo…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by acronis.com on acronis.com.
Mentioned in the excerpt
More from acronis.com1
- LOTUSLITE: Targeted espionage leveraging geopolitical themesacronis.com · Added 22 May
On the same topics
- Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor DeploymentQiAnXin · Published 11 May
- Nemty 1.6 Ransomware Released and Pushed via RIG Exploit KitBleepingComputer · Published 11 Oct 2019
- Osiris: An Enhanced Banking TrojanCheck Point · Published 31 Jul 2018
- SpeakUp: A New Undetected Backdoor Linux TrojanCheck Point · Published 4 Feb 2019
