cyber.hendryadrian.com
Security News · securityweek.com

Censys Finds Most Internet-Exposed REDCap Servers Are Outdated

· Original article ↗

Summary

Censys found about 8,500 internet-exposed REDCap instances, with only 1.18% running the latest version as of June 16, 2026. The finding is significant given reported targeting of legacy servers by China-linked actor UNC6508.

Key points

  • Censys observed approximately 8,500 internet-exposed REDCap instances worldwide; only 1.18% ran version 17.1.3, which it identified as the latest available, as of June 16, 2026.
  • About 30% of observed instances ran REDCap 16.0.17.
  • Google Threat Intelligence Group reported that China-linked actor UNC6508 targeted legacy REDCap servers in a campaign beginning in September 2023.
  • In one reported intrusion, attackers deployed custom malware to harvest login credentials and later used them to access the victim organization’s internal network and exfiltrate data; GTIG could not confirm how the REDCap server was initially compromised.
  • Organizations are advised to inventory REDCap instances, install a patched version, separate web and database servers, and secure the database behind a firewall.

Article Details

Event Type
Censys reported that most internet-accessible REDCap servers are running versions that may be outdated; GTIG reported that UNC6508 targeted legacy REDCap servers in a cyberespionage campaign.
Impact
In a reported incident, attackers harvested login credentials, later used them to access an organization’s internal network, and exfiltrated data. The attackers also deployed the InfiniteRed backdoor. Censys observed approximately 8,500 internet-exposed REDCap instances globally, with only 1.18% running the reported latest version as of June 16, 2026.

Threat Actors

UNC6508GTIG reported that this China-linked threat actor targeted legacy REDCap servers for cyberespionage, harvesting login credentials and, in one instance, deploying the InfiniteRed backdoor.

Malware

INFINITEREDIn one instance, the attackers deployed the InfiniteRed backdoor three months after the initial intrusion.

Vendors

Vanderbilt UniversityA browser-based platform used for building and managing clinical research data in the medical field, REDCap is developed by Vanderbilt University and is used by academic, healthcare, and non-profit organizations.

Products

REDCapThe majority of internet-accessible REDCap servers are running outdated software versions, making them prime targets for state-sponsored threat actors, according to internet intelligence firm Censys.

Countries

AustraliaThe UK (7.4%), Germany (4.8%), and Australia (3.9%) also expose numerous deployments to the web.GermanyThe UK (7.4%), Germany (4.8%), and Australia (3.9%) also expose numerous deployments to the web.United KingdomThe UK (7.4%), Germany (4.8%), and Australia (3.9%) also expose numerous deployments to the web.United States2023, as part of a campaign aimed at major medical, academic, and military research organizations in the US, the threat actor hacked web-facing REDCap servers and deployed custom malware for login credential

Industries

HealthcareA browser-based platform used for building and managing clinical research data in the medical field, REDCap is developed by Vanderbilt University and is used by academic, healthcare, and non-profit organizations.Military researchBeginning in September 2023, as part of a campaign aimed at major medical, academic, and military research organizations in the US, the threat actor hacked web-facing REDCap servers and deployed custom malware for login

Related Articles