Oct 31, 2026 · 23 min
Red Heron turns an exposed Gitea server into a foothold
The long road to root. [Research Saturday]
The campaign shows how a vulnerability in a development platform can lead to persistent Linux compromise across organizations and countries.
- 1Red Heron rapidly exploited a critical Gitea vulnerability to compromise organizations across multiple countries.
- 2The campaign combined custom code, public tools, persistent backdoors, and the Jitterly implant with a Linux rootkit.
- 3Defenders should patch Gitea, remove vulnerable instances from the internet, and investigate systems for signs of compromise.
Don't miss
Singha explains how exploiting Gitea enabled Red Heron to deploy persistent Linux malware and a rootkit.
The brief
Acronis researcher Subhajeet Singha describes how investigators found Red Heron’s open directory, exposing scripts, sensitive data, and clues to the actor’s operational arsenal.
Singha traces a campaign that mixed custom source code with public tools, exploited Gitea, and targeted organizations across Brazil, Paraguay, the United States, India, and Bhutan.
The actor’s sophistication appears in its loader capabilities, anti-analysis features, post-exploitation functions, and persistent Linux tooling, including Jitterly and a rootkit.
The defensive lesson is direct: patch the Gitea flaw, avoid exposing vulnerable instances online, use authenticated access controls, and check systems for compromise.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.