Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
A Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign.
“Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems,” the Acronis Threat Research Unit (TRU) said.
Scope of the Campaign
The campaign resulted in the compromise of 13 organizations across six countries. The threat actor focused on internet-facing Gitea instances, exploiting a remote code execution (RCE) vulnerability that had been recently disclosed.
Targeting and Reconnaissance
- Scanned 1,386 Gitea instances across seven countries.
- Maintained a separate dataset of 477 Taiwan-based systems.
- Compromised 13 organizations in six countries.
Attribution
Red Heron is a Chinese threat actor, according to the Acronis Threat Research Unit (TRU).
Key Facts
- Threat actor: Red Heron (China)
- Vulnerability: Gitea RCE
- Research unit: Acronis Threat Research Unit (TRU)
- Instances scanned: 1,386 across seven countries
- Separate Taiwan dataset: 477 systems
- Organizations compromised: 13 across six countries
