Loading story…
Google Threat Intelligence Group said UNC6508, a PRC-linked espionage group, compromised multiple North American organizations by targeting internet-exposed REDCap servers and then hiding inside victim networks for extended periods, in some cases for more than a year. The victims spanned medical research institutions, clinical providers, academic centers, military health organizations, advocacy groups, public health and regulatory bodies, and other entities tied to advanced technology and military readiness in the United States and Canada. Investigators traced the activity back to at least 2023 and said one intrusion began in September 2023 and remained undetected until late 2025.
After gaining access, the attackers deployed custom malware dubbed InfiniteRed, which provided persistence, credential harvesting, backdoor access, command-and-control, and upgrade interception, including by trojanizing REDCap-related system files. Using stolen credentials, the group moved into administrative accounts and internal systems, then abused Google Workspace content compliance rules to silently exfiltrate targeted emails by forwarding blind copies to an attacker-controlled Gmail account. Google said the stolen information included medical research, defense-related communications, AI and drone technology, military strategy, geo-strategic policy, and other sensitive research, and that it has since notified victims, disrupted attacker infrastructure, disabled the Gmail account used for exfiltration, and published indicators and detection guidance.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Censys reported that it observed more than 8,500 REDCap instances globally as of 2026-06-16, with the largest concentration in the United States. The analysis also found many exposed deployments running older 16.x versions and recommended patching, network segmentation, firewalls for database servers, and MFA for administrators.
Google Threat Intelligence Group publicly released its analysis of UNC6508, including technical details on InfiniteRed, indicators of compromise, and detection guidance. The report also documented the group's abuse of Google Workspace content compliance rules to exfiltrate targeted emails.
Google said it notified identified victims of the UNC6508 intrusions and took action against attacker infrastructure. The company disabled the Gmail account used for email exfiltration and disrupted related infrastructure.
Google said incident responders first identified the UNC6508 campaign in early 2025. From that investigation, Google tracked the activity and linked it to compromises affecting multiple organizations in the United States and Canada.
In one investigated intrusion, the attackers deployed the custom InfiniteRed malware three months after the initial compromise. The malware provided persistence, credential harvesting, backdoor, and command-and-control capabilities in REDCap environments.
Google said the PRC-linked group UNC6508 had been active since at least 2023, targeting North American medical, academic, and military research organizations. The campaign involved compromises of REDCap environments and theft of sensitive research and defense-related information.
Google reported that in at least one victim environment, UNC6508 maintained access from September 2023 through November 2025. This illustrated the group's ability to persist in compromised research networks for more than a year.
Google said UNC6508 likely exploited an older vulnerable REDCap deployment at a North American medical institution. The compromise began in September 2023 and later enabled theft of sensitive medical and research data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
22 references tracked. Mallory keeps watching after this page renders.
health-isac.org
Open sourcesecurityweek.com
Open sourcesecuritymagazine.com
Open sourcecensys.com
Open sourcetheregister.com
Open sourcecloud.google.com
Open sourcecloud.google.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group (**GTIG**), *Mandiant*, and industry partners reported disrupting infrastructure used by suspected China-nexus cyber-espionage actor **UNC2814**, assessed to have breached **at least 53 organizations across 42 countries**, with additional suspected infections in **20+** more countries. The activity primarily targeted **government** and **telecommunications** networks across Africa, Asia, and the Americas, and used **SaaS API calls** to blend command-and-control (C2) traffic into legitimate cloud application activity; the initial access vector remains under investigation, though the actor has a history of exploiting **web servers and edge systems**. The disrupted campaign featured a new C-based backdoor, **GRIDTIDE**, which abuses the **Google Sheets API** as an evasive C2 channel to exchange commands and data. Reported capabilities include arbitrary shell command execution and file upload/download; the malware authenticates using a Google service account (including a hardcoded private key), uses spreadsheet cells (e.g., `A1` for command/status and `A2:An` for output/exfiltration), and implements polling logic that shifts to less frequent randomized checks to reduce noise. Post-compromise tradecraft included lateral movement via **SSH** using a service account, **living-off-the-land** activity for recon/privilege escalation/persistence, persistence via a systemd service at `/etc/systemd/system/xapt.service` launching `/usr/sbin/xapt`, and use of **SoftEther VPN Bridge** to establish encrypted outbound connectivity.
Jun 29, 2026
Google’s *H1 2026 Cloud Threat Horizons* reporting described a sophisticated intrusion attributed with **moderate confidence** to North Korea-linked **UNC4899** (aka **Jade Sleet**, **PUKCHONG**, **Slow Pisces**, **TraderTraitor**) that targeted a cryptocurrency organization in 2025 and resulted in the theft of millions in cryptocurrency. The attack began with social engineering against a developer, who downloaded a malicious archive under the guise of open-source collaboration and then transferred it from a personal device to a corporate workstation via **AirDrop**; interaction with the archive led to execution of malicious Python that launched a backdoor binary masquerading as the Kubernetes CLI (`kubectl`). From the compromised endpoint, the actor pivoted into the cloud environment and used **living-off-the-cloud (LOTC)** techniques, abusing legitimate **DevOps workflows** to harvest credentials, escape container boundaries, and tamper with **Cloud SQL** databases to alter financial logic and enable theft. Separately, Google’s broader cloud incident trend analysis found attackers are increasingly using **newly disclosed third-party vulnerabilities**—not just weak credentials or misconfigurations—for initial access into cloud environments, with exploit “time-to-weaponization” shrinking from weeks to **days** (including cryptominer deployment within ~48 hours of disclosure). In Google’s reviewed intrusions, vulnerability exploitation was the leading initial access vector (44.5%) versus credentials (27%), with **RCE** flaws most frequently abused; examples cited include **React2Shell** (`CVE-2025-55182`) and an **XWiki** vulnerability (`CVE-2025-24893`) used in **RondoDox** botnet activity. The report also noted continued use of compromised identities via phishing/vishing (often help desk impersonation) and that many cloud intrusions prioritized **quiet, high-volume data exfiltration** and persistence over immediate extortion.
Jun 29, 2026
Google Threat Intelligence Group (GTIG) reported that the **defense industrial base (DIB)** is under sustained, multi-vector pressure from state-backed and aligned actors seeking to steal sensitive military technology, disrupt supply chains, and undermine national security. The report highlights Russian-linked activity focused on **unmanned aircraft systems (UAS)** and other emerging technologies, including **TEMP.Vermin** using drone-themed lures to deliver malware and **APT44 (Sandworm/GRU)** targeting military personnel devices with tooling such as **INFAMOUSCHISEL** to harvest data from battlefield-related applications; it also notes some Russian operators are using **LLMs** to improve reconnaissance and social-engineering effectiveness. GTIG also describes North Korea’s continued use of **IT-worker/insider** placement to generate revenue and access within Western organizations. Separately, reporting on **Transparent Tribe (APT36)** describes ongoing espionage campaigns against Indian government and defense targets across Windows and Linux, including spear-phishing that deploys **Geta RAT** and execution chains abusing legitimate Windows components (e.g., `mshta.exe`) and **XAML deserialization** for evasion, alongside a shift toward more mature Linux tooling and persistence. A third report (Picus Labs’ *Red Report*) is broader trend research rather than a specific incident, claiming ransomware encryption is declining while “**sleeperware**”/dormant extortion tradecraft is rising based on ATT&CK technique prevalence across large-scale simulation and telemetry; it does not materially add to the defense-sector espionage narrative beyond general attacker TTP trends.
Jun 29, 2026