Home › Threat Actors › UNC6508
← All Threat Actors
Nation-State high China (PRC)

UNC6508

Chinese state-sponsored (PRC-nexus, assessed with high confidence by Google Threat Intelligence Group) · Espionage — biomedical research, defence technology, and public health intelligence collection

Reports 1
Active Since September 2023
Last Reported 18 Jun 2026
Sectors Targeted healthcare, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • Probes internet-facing REDCap research servers for vulnerable legacy REDCap versions running alongside current ones (a downgrade approach); GTIG did not confirm the exact initial exploit
  • Deploys a help.php web shell; INFINITERED is a PHP backdoor that trojanizes REDCap files, with three components: an upgrade-intercepting dropper, a harvester for POST logins, and a backdoor triggered by a REDCAP-TOKEN cookie (commands include shell exec, upload, raw SQL and credential retrieval)
  • INFINITERED was deployed about three months after first compromise; harvested credentials were replayed more than a year later to reach a Google Workspace admin account
  • Google Workspace content compliance rule abuse: a rule named "Patroit" (sic) used regex matching to BCC-forward matching email to a Gmail account created through a mass-creation service; GTIG calls this novel for PRC-nexus actors
  • Exfiltration via legitimate cloud administrative features to avoid C2 network detection
  • Traffic routed through US-based obfuscation networks (compromised routers, residential proxies, VPS, IoT); the admin login came from a compromised ASUS router
  • Undetected for over a year per GTIG, with activity from September 2023 and last activity in November 2025

Known Targets

North American academic medical centres and clinical research organisationsNorth American military health institutionsProfessional advocacy groups and health regulatory bodiesInstitutions with molecular biology, drug discovery, clinical trial, and military medical readiness researchState-level public health organisations (US and Canada)Collection interests named by GTIG include Indo-Pacific Command operations, AI, uncrewed vehicle systems, cyber offensive programs, geo-strategic policy and the pathogen term "Chikungunya"

Analyst Notes

Disclosed by Google Threat Intelligence Group on 15 June 2026. Collection priorities align with longstanding PRC state intelligence requirements: biomedical research, defence technology and public health. GTIG names no aliases or other clusters. Indicators are in the GTIG report. The site's earlier "26+ months" dwell figure was arithmetic from the first and last activity dates, not a GTIG statement; GTIG says over one year undetected. MITRE IDs below are from GTIG's mapping where stated and otherwise the site's own mapping; verify against the report before reuse.

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application (REDCap) T1078 Valid Accounts (harvested credentials for lateral movement) T1114.003 Email Collection: Email Forwarding Rule (Google Workspace abuse) T1505.003 Web Shell T1554 Compromise Host Software Binary T1056.003 Web Portal Capture T1090.003 Multi-hop Proxy T1567 Exfiltration Over Web Service

Intelligence Reports

Briefing healthcarecritical-infrastructure

UNC6508: China-Linked Group Mined Medical and Military Research for Two Years

Google Threat Intelligence has disclosed a PRC-nexus espionage campaign that breached North American clinical, academic, and military health institutions via REDCap research servers, remaining undetected from September 2023 through November 2025.

18 Jun 2026 · 3 min read