Google Cloud
Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs
Part of the UNC6508 story · since 15 Jun
- Mon 15 Jun, 14:20 UTC. SecurityWeek, first report. Chinese Hackers Target Medical, Military, and AI Research in North America.
- Mon 15 Jun, 16:09 UTC. Google Cloud, its first report on the story. Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs. This article, 2nd of 7.
- Mon 15 Jun, 16:50 UTC. Dark Reading, its first report on the story. China-Nexus Actor Spied on US Researchers Undetected for a Year.
- Tue 16 Jun, 08:50 UTC. Security Affairs, its first report on the story. Chinese hackers stole data from US medical networks for two years.
- Thu 18 Jun, 17:20 UTC. SecurityWeek. Outdated REDCap servers expose research to China linked hackers.
- Mon 22 Jun, 13:22 UTC. SecurityOnline, its first report on the story. Google Uncovers UNC6508 Cyber Espionage Campaign.
- Tue 8 Sep, 12:07 UTC. Infosecurity, its first report on the story. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks.
The Google Threat Intelligence Group (GTIG) reported on a sophisticated cyber campaign attributed to the Chinese threat actor UNC6508, targeting North American academic, medical, and military institutions. This actor exploited REDCap servers to deploy custom malware, known as INFINITERED, which allowed covert data exfiltration from sensitive systems over an extended period.
The campaign, which began in September 2023, utilized techniques like credential harvesting, backdooring, and abusing domain content compliance rules for data theft. GTIG collaborated with Mandiant to detect and remediate the threat, advising organizations to take several preventative security measures including enforcing two-step verification and updating software. Comprehensive indicators of compromise (IOCs) and detailed actions for preventing similar attacks were also provided.
How the story developed
7 articles from 6 outlets since 15 Jun. Quiet since 8 Sep. This was the 2nd report, 2 hours after the first.
- Mon 15 Jun, 14:20 UTC. SecurityWeek, first report. Chinese Hackers Target Medical, Military, and AI Research in North America.
- Mon 15 Jun, 16:09 UTC. Google Cloud, its first report on the story. Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs. This article, 2nd of 7.
- Mon 15 Jun, 16:50 UTC. Dark Reading, its first report on the story. China-Nexus Actor Spied on US Researchers Undetected for a Year.
- Tue 16 Jun, 08:50 UTC. Security Affairs, its first report on the story. Chinese hackers stole data from US medical networks for two years.
- Thu 18 Jun, 17:20 UTC. SecurityWeek. Outdated REDCap servers expose research to China linked hackers.
- Mon 22 Jun, 13:22 UTC. SecurityOnline, its first report on the story. Google Uncovers UNC6508 Cyber Espionage Campaign.
- Tue 8 Sep, 12:07 UTC. Infosecurity, its first report on the story. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Mon 15 JunDay 03
- Chinese Hackers Target Medical, Military, and AI Research in North America14:20 · SecurityWeek · First report
- Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs16:09 · Google Cloud · This article, 2nd of 7
- China-Nexus Actor Spied on US Researchers Undetected for a Year16:50 · Dark Reading
- Tue 16 JunDay 11
- Chinese hackers stole data from US medical networks for two years08:50 · Security Affairs
Quiet for 2 days
Thu 18 JunDay 31- Outdated REDCap servers expose research to China linked hackers17:20 · SecurityWeek · Picked up again
Quiet for 4 days
Mon 22 JunDay 71- Google Uncovers UNC6508 Cyber Espionage Campaign13:22 · SecurityOnline · Picked up again
Quiet for 11 weeks
Tue 8 SepDay 851- Google Warns AI Coding Tools Fuel Software Supply Chain Attacks12:07 · Infosecurity · Picked up again