Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

A Chinese threat actor known as Red Heron has been linked to the exploitation of a security vulnerability in Gitea, using it to compromise internet-facing instances in a campaign that affected 13 organizations across six countries. Red Heron scanned a large number of Gitea instances, totaling 1,386, across seven countries. The threat actor also maintained a separate dataset of 477 systems based in Taiwan. This exploitation was part of a rapid response to a recently disclosed security vulnerability in Gitea. The campaign's scope and targets indicate a coordinated effort by Red Heron. The affected organizations were compromised as a result of Red Heron's exploitation of the Gitea vulnerability.