cyber.hendryadrian.com
Security News · cyberscoop.com

Google Uncovers China-Linked Espionage Group UNC6508 Active Since 2023

· Original article ↗

Summary

Google says UNC6508 targeted U.S. and Canadian organizations from at least September 2023, using the INFINITERED backdoor and exposed REDCap servers. Google disrupted some infrastructure and notified affected organizations; the campaign’s full scope remains unknown.

Key points

  • Google Threat Intelligence Group identified UNC6508, which it describes as a China-linked espionage group targeting U.S. and Canadian organizations.
  • Google traced the earliest known compromise to September 2023; a medical research university reportedly remained compromised through November 2025.
  • Google confirmed multiple victims were compromised with INFINITERED, a custom backdoor used to steal administrative credentials.
  • The group exploited externally facing REDCap servers, but researchers do not know how it initially accessed them.
  • Researchers said the group also abused domain compliance rules to steal data and routed traffic through U.S.-based IP addresses.
  • Google disrupted some known infrastructure, notified affected organizations and assisted with remediation; several unconfirmed compromise cases remain under investigation.

Article Details

Event Type
Discovery and partial disruption of a previously unknown cyber-espionage campaign targeting organizations in the United States and Canada.
Impact
Google reported that UNC6508 used the INFINITERED backdoor and exploited externally facing REDCap servers to steal administrative credentials, data, and communications. Some intrusions remained undetected from September 2023 until late 2025. The campaign’s full extent and impact are unknown; Google disrupted some known infrastructure and notified affected organizations, while several unconfirmed compromises remain under investigation.

People

Patrick WhitsellSenior security engineer at Google Threat Intelligence Group who described the campaign’s uncertain scope and the assessment that UNC6508 may continue to pose a threat.

Threat Actors

UNC6508Google identified UNC6508 as a previously unknown espionage group targeting organizations in the United States and Canada. The article describes the group as China-linked and China-sponsored; it reports that the group deployed INFINITERED, stole credentials and data, and remained undetected in some networks for years.

Malware

INFINITEREDThe group used the INFINITERED backdoor, abused REDCap servers and domain compliance rules, and remained undetected in some cases from September 2023 until late 2025.

Products

GmailGoogle said it disrupted some of UNC6508’s known infrastructure by disabling an Gmail account it used to exfiltrate data, notified the affected organizations and helped remediate compromises before it published researchREDCapThe group used the INFINITERED backdoor, abused REDCap servers and domain compliance rules, and remained undetected in some cases from September 2023 until late 2025.

Countries

CanadaThe campaign targeted organizations in the United States and Canada.United StatesGoogle Threat Intelligence Group uncovered UNC6508, a previously unknown China-linked espionage group that infiltrated U.S.

Industries

Academicand Canadian organizations for years to steal sensitive data from medical, academic, military, and policy targets.Cybersecuritybelonging to government and private organizations to steal data across academia, medicine, military, cybersecurity and foreign policy.Defense“We also assess that this highly capable threat actor will remain active and continue to be a threat to the defense, technology and medical industries for the foreseeable future.”Foreign policyand private organizations to steal data across academia, medicine, military, cybersecurity and foreign policy.Medicaland Canadian organizations for years to steal sensitive data from medical, academic, military, and policy targets.Militaryand Canadian organizations for years to steal sensitive data from medical, academic, military, and policy targets.Technology“We also assess that this highly capable threat actor will remain active and continue to be a threat to the defense, technology and medical industries for the foreseeable future.”

Related Articles