Google’s Threat Intelligence Group has exposed a prolonged Chinese espionage campaign that quietly looted sensitive biomedical and military health research from North American institutions for more than two years. The threat cluster, tracked as UNC6508, used a vulnerability in externally-facing REDCap research servers to gain initial access, deployed custom malware to harvest credentials, then weaponised victims’ own Google Workspace environments to exfiltrate data undetected. The campaign ran from September 2023 to at least November 2025.
Campaign Overview
UNC6508 is assessed by Google TIG with high confidence as a PRC-nexus espionage actor whose collection priorities align with longstanding Chinese state intelligence requirements: biomedical research, defence technology, and public health infrastructure.
The initial access vector was REDCap — Research Electronic Data Capture — a widely adopted web-based platform used across North American academic medical centres, clinical research organisations, and military health institutions for managing research databases and surveys. UNC6508 exploited vulnerabilities in externally-facing REDCap instances to gain a foothold, then deployed a custom implant called INFINITERED, which served simultaneously as dropper, credential harvester, and persistent backdoor.
Using credentials captured through INFINITERED, the actor moved from REDCap servers into the wider internal network. The persistence mechanism proved unusually difficult to detect: rather than moving data via conventional exfiltration channels, UNC6508 configured Google Workspace content compliance rules on compromised accounts to silently forward emails matching specific keywords to attacker-controlled Gmail addresses. This technique repurposed a legitimate administrative feature as a covert channel, with no obvious network anomaly to trigger alerting.
Targets and Data Taken
The campaign targeted a cross-section of North American research and health institutions:
- World-renowned clinical providers and academic medical centres
- North American military health institutions
- Professional advocacy groups and health regulatory bodies
Research areas of interest spanned molecular biology and drug discovery, ongoing clinical trials, state-level public health policy, and military medical readiness programmes. The breadth suggests collection requirements covering both long-term scientific intelligence and near-term tactical health intelligence of interest to PRC state sponsors.
Sector Implications
For healthcare and research security teams, this campaign highlights two underappreciated exposure surfaces.
Research platforms as attack entry points. REDCap is widely treated as a data management utility rather than a security-critical system, yet in this campaign it served as the primary intrusion vector into institutional networks. Any internet-facing research platform — REDCap, Qualtrics, or equivalent — deserves the same patch cadence and access controls applied to core enterprise infrastructure.
Legitimate cloud features as exfiltration channels. The Google Workspace compliance rule abuse is significant. By using a native, administrative feature, UNC6508 avoided the need for command-and-control infrastructure that might trigger network detection. Security teams at institutions using Google Workspace should treat unauthorised content compliance or email forwarding rules as a Tier 1 indicator of compromise.
Recommended Actions
- Audit and patch REDCap deployments immediately. Identify all externally-facing REDCap instances and apply current patches. If patching is delayed, restrict internet access to internal network only.
- Review Google Workspace compliance rules. Export all content compliance and email routing rules and validate each is authorised. Remove any rules forwarding to external addresses that cannot be attributed to a legitimate business process.
- Threat hunt for INFINITERED indicators. The Google TIG report contains INFINITERED indicators of compromise. Hunt for these across REDCap servers and adjacent systems, with particular attention to activity from September 2023 onwards.
- Implement MFA on all research platforms. Credential harvesting was central to UNC6508’s lateral movement. MFA on REDCap login and all associated research infrastructure directly constrains this technique.
- Classify research platform logs as security telemetry. Access logs from research platforms like REDCap should feed into SIEM infrastructure, not sit in application silos where they are only reviewed reactively.
Google’s full disclosure, including INFINITERED indicators, is available via the Google Cloud Threat Intelligence blog.