Red Heron Exploits Gitea RCE to Breach 13 Organizations Across Six Countries — Detection and Remediation Guide

---
title: Gitea Process Spawning Shell or Interpreter
description: Detects the Gitea service process spawning shells or script interpreters, consistent with post-exploitation of the Gitea RCE used by Red Heron. Git operations should never invoke interactive shells or interpreters directly.
references:
  - https://thehackernews.com/2026/09/red-heron-exploits-gitea-rce-to.html
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'gitea web'
      - '/app/gitea/gitea'
      - 'gitea serv'
  selection_image:
    CommandLine|contains:
      - '/bin/sh'
      - '/bin/bash'
      - '/bin/dash'
      - 'python'
      - 'perl'
      - 'curl '
      - 'wget '
      - 'base64 -d'
      - 'ncat'
      - 'nc -'
  condition: selection_parent and selection_image
falsepositives:
  - Gitea admin tooling or custom server-side hooks (post-receive, pre-receive) that legitimately invoke scripts — audit hooks under the repositories' hooks directories and whitelist known paths
level: high
---
title: Webshell or Suspicious File Write in Gitea Directories
description: Detects creation of executable or script files in Gitea custom public paths or temporary directories by the service account, consistent with webshell placement after exploitation.
references:
  - https://thehackernews.com/2026/09/red-heron-exploits-gitea-rce-to.html
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/09/15
status: experimental
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/gitea/custom/public/'
      - '/var/lib/gitea/custom/public/'
      - '/app/gitea/custom/public/'
  selection_ext:
    TargetFilename|endswith:
      - '.sh'
      - '.php'
      - '.py'
      - '.jsp'
      - '.war'
  selection_tmp:
    TargetFilename|startswith:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  condition: selection_path and selection_ext or selection_tmp
falsepositives:
  - Legitimate admin customization of public assets — review file content and writer process before dismissing
level: high
---
title: Gitea Host Initiating Outbound Connection to Rare Destination
description: Detects the Gitea service process establishing outbound network connections, which should be limited to known update, mirror, and webhook destinations. Novel egress from the git service account post-disclosure is a strong compromise indicator.
references:
  - https://thehackernews.com/2026/09/red-heron-exploits-gitea-rce-to.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/09/15
status: experimental
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|contains:
      - 'gitea'
    Initiated: 'true'
  filter_known:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection and not filter_known
falsepositives:
  - Repository mirroring, webhook delivery, and package proxying — baseline known destinations and alert on first-seen only
level: medium

// Hunt: Gitea service spawning shells/interpreters — Linux hosts via Syslog/Defender
// Pivot across both Defender for Endpoint telemetry and ingested Syslog for containerized/bare-metal hosts.
let giteaParents = dynamic(["gitea web", "gitea serv", "/app/gitea/gitea"]);
let suspiciousChildren = dynamic(["/bin/sh", "/bin/bash", "/bin/dash", "python", "perl", "curl", "wget", "ncat", "base64"]);
union isfuzzy=true
    (DeviceProcessEvents
     | where InitiatingProcessCommandLine has_any (giteaParents)
     | where ProcessCommandLine has_any (suspiciousChildren)
     | project TimeGenerated=TimeGenerated, Host=DeviceName, Source="MDE",
               Parent=InitiatingProcessCommandLine, Child=ProcessCommandLine,
               Account=AccountName, RemoteIP=""),
    (Syslog
     | where Facility =~ "user" or SyslogMessage has "gitea"
     | where SyslogMessage has_any (suspiciousChildren) and SyslogMessage has "gitea"
     | project TimeGenerated, Host=HostName, Source="Syslog",
               Parent="gitea", Child=SyslogMessage, Account="", RemoteIP=""))
| order by TimeGenerated desc;
// Hunt: Egress from Gitea hosts to first-seen external destinations (7-day baseline vs last 24h)
let lookback = 7d;
let recent = 1d;
let baseline =
    DeviceNetworkEvents
    | where TimeGenerated > ago(lookback) and TimeGenerated < ago(recent)
    | where InitiatingProcessName has "gitea" or InitiatingProcessFolderPath has "gitea"
    | summarize by RemoteIP, RemoteUrl;
DeviceNetworkEvents
| where TimeGenerated > ago(recent)
| where InitiatingProcessName has "gitea" or InitiatingProcessFolderPath has "gitea"
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| where RemoteIP !in (baseline | project RemoteIP)
| summarize Connections=count(), Ports=make_set(RemotePort) by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessCommandLine
| order by Connections desc;

-- Hunt for post-exploitation indicators on Gitea hosts:
-- 1) gitea/git service account spawning unexpected child processes
-- 2) recently modified executable/script files in Gitea custom public paths and temp dirs
-- 3) current outbound connections from the gitea process

-- Child processes of the gitea service
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (CommandLine =~ '(?i)(bash|sh|dash|python|perl|curl|wget|ncat|base64)'
   AND Username =~ '(?i)git')
   OR Name =~ '(?i)^gitea$'

-- Recently written scripts/executables in high-risk paths
SELECT FullPath, Size, Mtime, Ctime, Mode
FROM glob(globs=['/var/lib/gitea/custom/public/**', '/app/gitea/custom/public/**',
                 '/tmp/*.sh', '/dev/shm/*', '/var/tmp/*'])
WHERE Mtime > now() - 604800
  AND (FullPath =~ '(?i)\.(sh|php|py|jsp|war|elf)$' OR Mode =~ 'x')
ORDER BY Mtime DESC

-- Live egress from gitea process
SELECT Pid, Name, Status, LocalAddr, RemoteAddr
FROM netstat()
WHERE Name =~ '(?i)gitea'
  AND Status =~ 'ESTABLISHED'
  AND RemoteAddr !~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'

#!/usr/bin/env bash
# Gitea compromise assessment and hardening — run on every Gitea host (bare metal or container host).
# Run as root. Review output before making destructive changes.

set -euo pipefail
echo "=== [1] Gitea version check ==="
# Find the binary and report version; compare against latest stable at https://dl.gitea.com/gitea/
GITEA_BIN=$(command -v gitea || ls /usr/local/bin/gitea /app/gitea/gitea 2>/dev/null | head -1 || true)
if [ -n "$GITEA_BIN" ]; then "$GITEA_BIN" --version; else echo "gitea binary not found in PATH — check container: docker exec <container> gitea --version"; fi

echo "=== [2] Exposure check — is Gitea listening on a public interface? ==="
ss -tlnp 2>/dev/null | grep -Ei 'gitea|:3000' || echo "No direct gitea listener found (may be behind reverse proxy — check nginx/traefik configs)"

echo "=== [3] Suspicious child processes of gitea service ==="
GITEA_PID=$(pgrep -f 'gitea web' | head -1 || true)
if [ -n "$GITEA_PID" ]; then
  ps --ppid "$GITEA_PID" -o pid,ppid,user,cmd --forest
  pstree -p "$GITEA_PID" 2>/dev/null || true
else echo "gitea web process not found"; fi

echo "=== [4] Recently modified files in web-served / temp paths (last 7 days) ==="
find /var/lib/gitea/custom/public /app/gitea/custom/public /tmp /dev/shm /var/tmp \
  -type f \( -name '*.sh' -o -name '*.php' -o -name '*.py' -o -name '*.jsp' -o -perm -111 \) \
  -mtime -7 -ls 2>/dev/null || true

echo "=== [5] Git service account persistence — SSH keys and cron ==="
ls -la /home/git/.ssh/ 2>/dev/null || true
cat /home/git/.ssh/authorized_keys 2>/dev/null || echo "no authorized_keys for git user"
crontab -l -u git 2>/dev/null || echo "no crontab for git user"
ls -la /etc/cron.d/ 2>/dev/null | grep -iv '^total' || true

echo "=== [6] Unauthorized local users / recent logins ==="
awk -F: '($3 >= 1000 || $3 == 0) {print $1, $3, $6}' /etc/passwd
last -n 30 2>/dev/null || true

echo "=== [7] Egress connections from gitea ==="
ss -tnp 2>/dev/null | grep -i gitea || echo "no established gitea connections"

echo "=== [8] Upgrade path ==="
echo "Backup first: gitea dump -c /path/to/app.ini"
echo "Then deploy the latest stable release from https://dl.gitea.com/gitea/ (verify checksum/signature)"
echo "Docker: pin to the latest patched tag, e.g. docker pull gitea/gitea:latest -> recreate container"

echo "=== Assessment complete. If sections 3-6 returned unexpected results, isolate the host and initiate IR. ==="