Red Heron Exploits Gitea RCE to Compromise 13 Organizations

A Chinese threat actor identified as Red Heron has been linked to the swift exploitation of a recently disclosed remote code execution (RCE) vulnerability within the Gitea software. This exploitation formed the basis of a multi-national campaign that successfully compromised 13 organizations across six different countries. The Acronis Threat Research Unit (TRU) reported that Red Heron actively scanned 1,386 Gitea instances situated across seven countries, and maintained a distinct dataset comprising 477 systems located in Taiwan. This indicates a targeted and widespread effort to leverage the Gitea vulnerability for malicious purposes.

The specific vulnerability exploited by Red Heron is identified as CVE-2023-38999, a critical RCE flaw that allows unauthenticated attackers to execute arbitrary code on vulnerable Gitea servers. Gitea is a lightweight, self-hosted Git service that is popular among developers and organizations for managing their code repositories. Its widespread adoption means that a vulnerability within its core functionality can have significant implications for software development infrastructure.

The campaign's multi-national scope, affecting organizations in at least six countries, underscores the global reach of cyber threats and the interconnectedness of software supply chains. The threat actor's ability to scan such a large number of instances and successfully compromise a subset of them highlights the effectiveness of their exploitation techniques and the potential impact of unpatched vulnerabilities. The targeting of Taiwan-based systems specifically suggests a potential focus or interest in that region.

Acronis TRU's analysis indicates that Red Heron utilized the compromised Gitea instances to establish a foothold within the victim networks. From these compromised servers, the threat actor then proceeded to deploy additional malicious tools and conduct further reconnaissance, likely in preparation for more sophisticated attacks such as data exfiltration or the deployment of ransomware. The rapid exploitation following the disclosure of CVE-2023-38999 suggests that Red Heron was either aware of the vulnerability prior to its public disclosure or was exceptionally quick to adapt once the information became available. This rapid response is characteristic of advanced persistent threat (APT) groups.

The compromise of 13 organizations highlights the critical importance of timely patching and robust security practices for internet-facing applications like Gitea. Organizations relying on self-hosted services must maintain vigilant security monitoring and ensure that their software is updated to the latest secure versions to mitigate the risk of exploitation by threat actors like Red Heron. The ongoing nature of such campaigns necessitates continuous threat intelligence gathering and proactive defense strategies.