Security AffairsPierluigi Paganini
Chinese hackers stole data from US medical networks for two years
Part of the UNC6508 story · since 15 Jun
- Mon 15 Jun, 14:20 UTC. SecurityWeek, first report. Chinese Hackers Target Medical, Military, and AI Research in North America.
- Mon 15 Jun, 16:09 UTC. Google Cloud, its first report on the story. Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs.
- Mon 15 Jun, 16:50 UTC. Dark Reading, its first report on the story. China-Nexus Actor Spied on US Researchers Undetected for a Year.
- Tue 16 Jun, 08:50 UTC. Security Affairs, its first report on the story. Chinese hackers stole data from US medical networks for two years. This article, 4th of 7.
- Thu 18 Jun, 17:20 UTC. SecurityWeek. Outdated REDCap servers expose research to China linked hackers.
- Mon 22 Jun, 13:22 UTC. SecurityOnline, its first report on the story. Google Uncovers UNC6508 Cyber Espionage Campaign.
- Tue 8 Sep, 12:07 UTC. Infosecurity, its first report on the story. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks.
A cyberespionage group linked to China, known as UNC6508, infiltrated North American medical research networks for over two years, starting from September 2023. This group was discovered in November 2025, indicating a lack of visibility in network defenses. They employed a custom malware named INFINITERED to capture credentials and forward emails undetected. Their primary targets were significant healthcare institutions and military health organizations, with intrusions commonly initiated through REDCap servers.
Google has identified specific security recommendations to mitigate further risks, including updating REDCap systems, reviewing email security settings, and improving monitoring capabilities.
How the story developed
7 articles from 6 outlets since 15 Jun. Quiet since 8 Sep. This was the 4th report, 18 hours after the first.
- Mon 15 Jun, 14:20 UTC. SecurityWeek, first report. Chinese Hackers Target Medical, Military, and AI Research in North America.
- Mon 15 Jun, 16:09 UTC. Google Cloud, its first report on the story. Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs.
- Mon 15 Jun, 16:50 UTC. Dark Reading, its first report on the story. China-Nexus Actor Spied on US Researchers Undetected for a Year.
- Tue 16 Jun, 08:50 UTC. Security Affairs, its first report on the story. Chinese hackers stole data from US medical networks for two years. This article, 4th of 7.
- Thu 18 Jun, 17:20 UTC. SecurityWeek. Outdated REDCap servers expose research to China linked hackers.
- Mon 22 Jun, 13:22 UTC. SecurityOnline, its first report on the story. Google Uncovers UNC6508 Cyber Espionage Campaign.
- Tue 8 Sep, 12:07 UTC. Infosecurity, its first report on the story. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Mon 15 JunDay 03
- Chinese Hackers Target Medical, Military, and AI Research in North America14:20 · SecurityWeek · First report
- Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs16:09 · Google Cloud
- China-Nexus Actor Spied on US Researchers Undetected for a Year16:50 · Dark Reading
- Tue 16 JunDay 11
- Chinese hackers stole data from US medical networks for two years08:50 · Security Affairs · This article, 4th of 7
Quiet for 2 days
Thu 18 JunDay 31- Outdated REDCap servers expose research to China linked hackers17:20 · SecurityWeek · Picked up again
Quiet for 4 days
Mon 22 JunDay 71- Google Uncovers UNC6508 Cyber Espionage Campaign13:22 · SecurityOnline · Picked up again
Quiet for 11 weeks
Tue 8 SepDay 851- Google Warns AI Coding Tools Fuel Software Supply Chain Attacks12:07 · Infosecurity · Picked up again