Google’s Threat Intelligence Group (GTIG) reports that a China-linked cyber espionage campaign compromises North American medical research institutions by targeting exposed REDCap servers. GTIG says the activity is attributed to UNC6508, a threat actor associated with the People’s Republic of China. The researchers report that UNC6508 exploits vulnerabilities in REDCap instances and uses custom malware to establish persistence and access internal environments. GTIG states the campaign remains undetected in victim systems for an extended period—over a year—and that activity began in September 2023.
Bleeping Computer similarly reports that the campaign focuses on REDCap servers that are accessible to the public. In that account, the attackers deploy InfiniteRed malware after gaining access and then exfiltrate sensitive information from a North American medical institution. Both sources describe the same overarching pattern: initial compromise through vulnerable or exposed REDCap infrastructure, followed by malware deployment, prolonged stealth, and theft of research-related data.
