China-Linked Hackers Swipe Medical and Defense Secrets
Quick answer
Google uncovers China-linked UNC6508 hacking medical and defense targets via REDCap exploits and email rule abuse. Learn how to protect your data.
Google’s Threat Intelligence Group (GTIG) has uncovered a year-long espionage campaign by a China-linked threat actor, UNC6508, targeting North American medical, academic, and military research institutions. The attackers exploited REDCap servers, deployed custom malware, and abused enterprise email rules to siphon sensitive data on AI, cyber warfare, and national defense. It’s a reminder that even the most secure swamps have hidden channels—time to check your perimeter.
How They Got In
UNC6508 targeted REDCap, a web platform for medical research surveys. They exploited legacy versions and deployed a custom malware called INFINITERED, which stole login credentials and persisted through upgrades. The malware hid in plain sight, intercepting the upgrade process to maintain access.
The INFINITERED Malware
INFINITERED is a modular PHP backdoor with three components: a dropper that intercepts REDCap upgrades, a credential harvester that captures usernames and passwords, and a backdoor that communicates via HTTP cookies. It can execute shell commands, run SQL queries, and exfiltrate files. The malware uses a GUID delimiter to inject its code into new REDCap versions, ensuring persistence even after updates.
Data Exfiltration via Email Rules
After stealing admin credentials, UNC6508 created a content compliance rule named “Patroit” in Google Workspace. This rule silently BCC-forwarded emails matching keywords related to defense, AI, and medical research to a Gmail account controlled by the attackers. This novel technique allowed continuous, covert data theft.
What Was Targeted
The campaign focused on a broad range of intelligence: Indo-Pacific military operations, uncrewed vehicle systems, cyber offensive programs, and medical research. The keyword list even included “Chikungunya,” a virus that caused an outbreak in China in 2025, suggesting strategic alignment with PRC interests.
Protect Your Swamp
GTIG recommends enabling 2-Step Verification, monitoring audit logs, patching REDCap, and using Data Loss Prevention rules. For a deeper dive into securing your cloud infrastructure, check out our Google Cloud review and Supabase review. Stay vigilant, capybaras—the caimans are always lurking.
Original announcement published on Google Cloud.