Act
active
Red Heron Exploits Gitea RCE, Compromises 13 Orgs Across Six Countries
- Engineer — Act: Active exploitation of a Gitea RCE by a suspected Chinese actor with 13 confirmed compromises makes this urgent for anyone running an internet-facing Gitea instance. Patch Gitea to the latest version immediately and audit access logs for unauthorized RCE attempts.
- SOC/IR — Act: Red Heron scanned over 1,300 Gitea instances as part of this campaign, suggesting systematic targeting; hunt for exploitation attempts against any Gitea instances in your environment and check for post-compromise lateral movement patterns consistent with Chinese espionage actors since the campaign began.
- Leader — Learn: A confirmed multi-national espionage campaign exploiting a self-hosted developer tool is worth awareness for context on Chinese threat actor tempo, but Gitea is niche enough that this does not rise to board-level action unless your organization specifically runs it.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.