cyber.hendryadrian.com
Security News · securityweek.com

Google Reports Chinese-Linked UNC6508 Targeting North American Research Organizations

· Original article ↗

Summary

Google says the suspected Chinese government-linked group UNC6508 targeted North American medical, academic and military research organizations, using InfiniteRed malware and email content-compliance rules to collect information.

Key points

  • Google tracked UNC6508 from early 2025 and believes the group has been active since at least 2023.
  • Targets included medical, academic and military research organizations in the US and Canada, as well as entities connected to national security, AI, drones and defense.
  • The group regularly targeted REDCap servers; Google said the access method is unclear, though evidence suggests possible targeting of vulnerable legacy versions.
  • In one investigated intrusion, attackers deployed the custom InfiniteRed malware three months after initial access. It supports credential harvesting, backdoor access and command-and-control.
  • Attackers used content-compliance rules to collect emails related to selected topics.
  • Google said it disrupted the group's infrastructure, notified identified victims and released technical details and indicators of compromise.

Article Details

Event Type
Cyberespionage campaign targeting research organizations
Impact
GTIG reported that UNC6508 targeted medical, academic, and military research organizations in North America, with apparent interest in national security, AI, drones, cyber offensive research, defense technology, and other government and military intelligence. In one investigated intrusion, the group deployed the InfiniteRed malware, which supports credential harvesting and command-and-control, and used content compliance rules to exfiltrate topic-related emails. Google said it disrupted the group’s infrastructure and notified identified victims.

MITRE ATT&CK

T1114 · Email CollectionGTIG reported that the attackers used content compliance rules to collect and exfiltrate emails related to specific topics.

Threat Actors

UNC6508GTIG reported that UNC6508 conducted cyberespionage intrusions targeting North American medical, academic, and military research organizations. The group is believed to be linked to the Chinese government and to have been active since at least 2023.

Malware

INFINITEREDIn one of the intrusions investigated by the tech giant’s researchers, the hackers deployed a piece of malware named InfiniteRed three months after the initial intrusion. 

Products

REDCapAccording to GTIG, the cyberspies regularly target servers hosting REDCap, a web platform for building and managing clinical research databases and surveys in the medical field.

Countries

CanadaThe malware was discovered on the systems of multiple organizations in the US and Canada.United StatesThe malware was discovered on the systems of multiple organizations in the US and Canada.

Related Articles