Google disrupts Chinese espionage of US and Canada research

A sophisticated cyberespionage campaign linked to China infiltrated prestigious academic, medical, and military research networks in the United States and Canada, remaining undetected for more than a year before being discovered and disrupted by Google's Threat Intelligence Group. The campaign, attributed to a state-linked threat actor tracked as UNC6508, targeted institutions managing billions of dollars in research funding across critical fields including national defense, artificial intelligence, unmanned vehicles, and advanced medicine.

The earliest known compromise occurred in September 2023, with malicious activity continuing consistently through November 2025. The hackers gained initial access by exploiting vulnerabilities in externally facing servers running REDCap, a widely used web application for managing clinical research databases and surveys. They specifically targeted older, legacy versions of the software.

Once inside a network, the group deployed a custom piece of malware named INFINITERED, designed specifically for REDCap systems. The malware was engineered to persist through software updates, harvest login credentials by capturing usernames and passwords from...