Google details UNC6508 campaign targeting REDCap servers
Summary
Google Threat Intelligence Group attributes a year-plus campaign against exposed REDCap servers at a North American medical institution to China-linked UNC6508, which deployed InfiniteRed and used a compliance rule to exfiltrate matching data by email.
Key points
- Google Threat Intelligence Group attributes the campaign to China-linked UNC6508; activity at the medical institution began in September 2023 and continued through November 2025.
- Researchers could not determine the initial compromise vector but observed UNC6508 probing older, vulnerable REDCap versions.
- The custom InfiniteRed malware included a persistence and update module, a credential harvester, and a backdoor.
- The malware harvested REDCap login credentials; its backdoor received commands through HTTP cookies and could run shell commands, transfer files, and execute SQL queries.
- After gaining administrator access, UNC6508 created a compliance rule to scan for selected content and automatically BCC matching emails to an account that Google has since disabled.
- Google advised upgrading REDCap, removing legacy deployments, enabling MFA or 2SV and DBSC, and using the report's YARA rules and indicators to check for infections.
Article Details
- Attack Vectors
- UNC6508 probed exposed, older REDCap versions before compromising a medical research organization; the exact initial compromise vector was not determined.
- Three months after the initial compromise, the attackers deployed InfiniteRed, whose components were hidden by trojanizing server system files.
- InfiniteRed captured usernames and passwords submitted through REDCap login pages and stored them in local database tables.
- The backdoor received commands via HTTP cookies and could execute shell commands, transfer files, and run SQL queries.
- After gaining administrator access, UNC6508 created a content compliance rule that sent matching email content as a BCC to a Gmail account.
- Defensive Notes
- Upgrade REDCap instances to the latest available versions and remove legacy deployments.
- Use MFA/2SV on high-privilege accounts.
- Use Device Bound Session Credentials (DBSC) to help prevent session hijacking.
- Use the report's YARA rules and indicators of compromise to scan for InfiniteRed infections.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
bebitabarefoot774@gmail[.]com | Google disabled this Gmail account after UNC6508 used it as the BCC destination for data exfiltrated by a content compliance rule. |
MITRE ATT&CK
T1056.003 · Web Portal CaptureInfiniteRed's login harvester captured usernames and passwords submitted through REDCap login pages.T1071.001 · Web ProtocolsInfiniteRed's backdoor received commands via HTTP cookies.T1114.003 · Email Forwarding RuleUNC6508 created a content compliance rule that sent matching email content as a BCC to an account they used for exfiltration.T1554 · Compromise Host Software BinaryThe attackers hid InfiniteRed components by trojanizing the REDCap server's system files.
Threat Actors
Malware
Vendors
Products
GmailThe campaign lasted more than a year and used novel email-based exfiltration through a legitimate compliance feature to send matching records to a Gmail account.REDCapGoogle Threat Intelligence Group says China-linked UNC6508 targeted exposed REDCap servers to deploy the custom InfiniteRed malware and quietly steal sensitive data from a North American medical institution.
Countries
Canadaand Canada that were compromised with the InfiniteRed malware.United StatesGTIG observed a high level of operational security across this campaign, including the use of US-based residential proxy infrastructure, compromised routers, VPS, credential replay, and dedicated infrastructure for data