Security researchers report that a China-linked espionage group accesses North American medical, academic, and defense-related research networks for more than a year, stealing sensitive research information and email tied to defense activities. The intrusion begins with a backdoor placed on REDCap research servers, which the attackers use to obtain login credentials. After establishing access, the group targets email accounts in the affected environments.
A key detail across reporting is the group’s exfiltration technique. Instead of using a conventional data-dumping method, the attackers reconfigure victims’ Google Workspace settings—specifically, by altering the organization’s own Workspace rules. By rewriting these rules, the attackers cause copies of selected messages to be automatically forwarded or copied to attacker-controlled destinations. This approach allows the group to extract information that matches certain criteria while using legitimate tooling and existing email workflow mechanisms.
The reporting emphasizes that the exfiltration method is the unusual part of the campaign, while the initial access leverages compromised REDCap infrastructure and stolen credentials.
