This threat involves a cyber espionage operation attributed to Chinese actors who exploited exposed REDCap servers to deploy the InfiniteRed malware. The malware facilitated unauthorized access and data theft from a medical research institution in North America. The campaign targeted REDCap servers with no detailed information on specific vulnerabilities or affected versions. No vendor advisories or patches are referenced, and the servers are not cloud-hosted, implying remediation depends on the affected organizations. The attack highlights the risk of exposed REDCap instances being leveraged for espionage and data theft.

Sensitive medical research data was stolen from a North American institution due to unauthorized access via compromised REDCap servers. The breach potentially compromises confidentiality and intellectual property related to medical research. There is no information about further spread or additional impacts beyond data theft.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations using REDCap should ensure their servers are not publicly exposed and apply any available security updates. Network segmentation and access controls should be reviewed to prevent unauthorized access. Monitoring for signs of compromise related to InfiniteRed malware is recommended.