Google’s Threat Intelligence Group has tracked the Chinese-linked cyberespionage group UNC6508 since early 2025, with activity dating back to at least 2023. UNC6508 targets North American organizations in medical, academic, and military research sectors, including clinical providers, academic centers, and military health institutions. The group exploits vulnerable legacy versions of REDCap, a platform for clinical research data management, to gain access. They deploy a custom malware payload called InfiniteRed, which provides dropper, credential harvesting, backdoor, and command-and-control capabilities. The attackers use obfuscation networks, legitimate credentials, and operation-specific infrastructure to evade detection. Their objectives include stealing intelligence on medicine, AI, drones, cyber offensive research, defense technology, naval assets, diplomatic and government entities, and military command units. Google has disrupted their infrastructure and shared IoCs to assist defenders.

The threat actor UNC6508 conducts cyberespionage targeting sensitive research and national security-related information in North America. The compromise of REDCap servers and deployment of InfiniteRed malware enables persistent access, credential theft, and data exfiltration from high-value medical, military, and AI research organizations. This results in the exposure of confidential clinical research data, military readiness information, and advanced technology intelligence, potentially undermining national security and competitive research advantages.

Google has disrupted the threat actor's infrastructure and notified affected organizations. Defenders should review the technical details and indicators of compromise released by Google’s Threat Intelligence Group to detect and remediate infections. Organizations using REDCap should verify they are not running vulnerable legacy versions and apply any available updates or security controls. Patch status is not explicitly confirmed; check vendor advisories for REDCap for current remediation guidance. Employ monitoring for suspicious activity related to InfiniteRed malware behaviors and unauthorized use of content compliance rules.