UNC6508 deployed custom malware through REDCap servers, stealing sensitive emails via fake compliance rules.
Summary
- Chinese state-sponsored group UNC6508 maintained hidden access to North American medical and military research networks for over a year starting in 2023
- Attackers exploited REDCap servers and deployed custom InfiniteRed malware to harvest credentials and establish persistence
- Data theft occurred through fake email compliance rules that forwarded sensitive communications to attacker-controlled Gmail accounts
- Stolen intelligence included defence platform information, drone technology research, and medical data on viral diseases including Chikungunya
Attack Timeline and Scope
Chinese government-linked espionage group UNC6508 maintained covert access to multiple North American medical and military research organisations for more than a year, according to Google Threat Intelligence. The campaign, first detected in early 2025, dates back to at least September 2023. Google identified multiple US and Canadian organisations as victims but declined to specify exact numbers, with analysts suspecting additional undiscovered compromises.
REDCap as Initial Vector
All intrusions followed the same pattern, beginning with exploitation of externally facing REDCap servers. These Research Electronic Data Capture systems are widely used by universities, hospitals, and research institutions to manage online databases, surveys, and sensitive clinical research data. The consistent targeting of REDCap infrastructure suggests a deliberate strategy to access high-value research environments.
Custom Malware Deployment
Three months after initial compromise, UNC6508 deployed custom malware called InfiniteRed designed specifically for REDCap environments. The malware operates through three components: maintaining persistence by injecting code during system upgrades, harvesting credentials through authentication system manipulation, and functioning as a backdoor that executes on every page load. This sophisticated approach enabled the group to capture legitimate user credentials and establish long-term access.
Data Exfiltration Method
The attackers used a particularly clever exfiltration technique involving fake email compliance rules. They created a rule misspelled as ‘Patroit’ that automatically forwarded emails containing specific keywords to an attacker-controlled Gmail address, BebitaBarefoot774@gmail.com. This method leveraged legitimate administrative features to silently capture sensitive communications without triggering security alerts.
Intelligence Targets
The group’s search terms revealed broad intelligence collection priorities spanning defence and medical research. According to Google’s Luke McNamara, the attackers sought emails related to drone technology, unmanned vehicles, defence platform systems, and specific companies. Medical targets included research on Chikungunya, a mosquito-transmitted viral disease that caused an outbreak in China’s Guangdong province. The eclectic mix suggests either multi-domain intelligence requirements or copy-paste deployment across different victim types.
Why it matters
This campaign demonstrates how state actors exploit trusted research infrastructure to maintain long-term access while leveraging legitimate administrative features for data theft. The year-plus dwell time and sophisticated persistence mechanisms highlight significant detection challenges in research environments that handle sensitive dual-use technologies and medical data.
What to do now
- Audit external-facing REDCap servers for compromise indicators and unauthorised modifications
- Review email compliance rules for suspicious forwarding configurations, particularly rules with misspellings or unusual recipient addresses
- Monitor for InfiniteRed malware components in REDCap environments and engage Google Threat Intelligence for removal assistance if detected
- Implement enhanced monitoring of credential usage patterns in research database systems
