Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries Ravie LakshmananSep 14, 2026Cyber Espionage / Vulnerability A Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. "Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems," Acronis Threat Research Unit (TRU) said in an analysis. "The activity progressed from source-code theft to persistent access, credential collection, and lateral movement, including root-level access to a three-node Proxmox cluster." The activity is said to have resulted in confirmed compromises affected organizations in Canada (2), Argentina (1), Taiwan (4),…