China-Linked Red Heron Turns Gitea Flaw Into a Seven-Country Break-In Spree

Key points

• A Chinese hacking group tracked as Red Heron exploited a recently disclosed flaw in Gitea, a self-hosted platform companies use to store their source code.
• Acronis Threat Research Unit says the group scanned 1,386 Gitea servers across seven countries and kept a separate list of 477 systems in Taiwan.
• The campaign broke into 13 organisations across six countries, according to Acronis.
• Red Heron moved fast after the Gitea flaw became public, turning a fresh patch notice into a live intrusion campaign within days.
• Any organisation running an internet-facing Gitea server should assume it was probed and check for signs of intrusion.

A Chinese hacking crew that researchers call Red Heron has been racing through the internet looking for companies that run their own copy of Gitea, an open-source platform used to host and manage software code.

The group exploited a recently disclosed flaw to break in. Once past the login page, it can reach source code, credentials and the internal tools developers leave sitting in a repository.

Acronis Threat Research Unit, which named the group, says Red Heron scanned 1,386 Gitea servers across seven countries. It also kept a second, separate list of 477 servers in Taiwan, a strong signal that Taiwanese organisations were a priority. We've covered the flaw itself in depth: our 28 August story found 8,300 Gitea servers still exposed when most operators still hadn't patched.

The campaign, first reported by The Hacker News, has led to confirmed break-ins at 13 organisations across six countries.

What is Gitea and why does it matter?

Gitea is a free tool companies install on their own servers to store source code, much like a private, in-house version of GitHub. It's popular with firms that want to keep their code inside their own network rather than in a big cloud service.

That also makes it a rich target. Anyone who gets in can read proprietary code, lift API keys and tokens saved there, and sometimes tamper with software before it ships to customers.

How did Red Heron get in?

The group exploited a remote code execution flaw, a class of bug that lets an attacker run commands on the server from across the internet without physical access. That vulnerability was publicly disclosed a short time before the campaign began.

Red Heron moved fast: it scanned exposed versions, hit what it found, and kept a curated list of Taiwan-based systems for closer attention. The window between a patch notice and active weaponisation keeps shrinking, and small teams running self-hosted developer tools rarely patch on the day a fix drops.

Who was hit?

Acronis has not publicly named the 13 victim organisations or the specific countries involved beyond noting the Taiwan focus.

What should defenders do now?

If your organisation runs Gitea on a server reachable from the internet, treat it as urgent. Update to the latest patched release, check access logs for unfamiliar logins or unexpected command execution, and rotate any keys or tokens stored in repositories on that server.

Ordinary customers and staff of affected companies don't need to take direct action yet. The risk sits with the businesses whose code and credentials may have been stolen. If those companies later report follow-on breaches, such as leaked customer data or tampered software updates, that's when the impact will reach the rest of us.

Red Heron's Taiwan focus fits a wider pattern of Chinese state-aligned groups going after Taiwanese industry and government. Taiwan's Ministry of Digital Affairs confirmed AI-assisted attacks on government systems in July, and this campaign lands in the same thread. Expect more of the same as fresh flaws in developer tools surface.