Dark ReadingElizabeth Montalbano
China-Nexus Actor Spied on US Researchers Undetected for a Year
Part of the UNC6508 story · since 15 Jun
- Mon 15 Jun, 14:20 UTC. SecurityWeek, first report. Chinese Hackers Target Medical, Military, and AI Research in North America.
- Mon 15 Jun, 16:09 UTC. Google Cloud, its first report on the story. Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs.
- Mon 15 Jun, 16:50 UTC. Dark Reading, its first report on the story. China-Nexus Actor Spied on US Researchers Undetected for a Year. This article, 3rd of 7.
- Tue 16 Jun, 08:50 UTC. Security Affairs, its first report on the story. Chinese hackers stole data from US medical networks for two years.
- Thu 18 Jun, 17:20 UTC. SecurityWeek. Outdated REDCap servers expose research to China linked hackers.
- Mon 22 Jun, 13:22 UTC. SecurityOnline, its first report on the story. Google Uncovers UNC6508 Cyber Espionage Campaign.
- Tue 8 Sep, 12:07 UTC. Infosecurity, its first report on the story. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks.
A China-aligned threat actor, UNC6508, conducted an extensive spying campaign on US academic, medical, and military institutions for over a year, utilizing custom malware to steal credentials from researchers' Web applications. Discovered by Google Threat Intelligence Group, this operation targeted sensitive data from multiple high-profile organizations and showcased innovative data exfiltration techniques, making detection challenging.
Google collaborated with Mandiant to disrupt the activity and alerts other potential targets. Recommendations for organizations include enforcing two-factor authentication and monitoring for unauthorized changes.
How the story developed
7 articles from 6 outlets since 15 Jun. Quiet since 8 Sep. This was the 3rd report, 3 hours after the first.
- Mon 15 Jun, 14:20 UTC. SecurityWeek, first report. Chinese Hackers Target Medical, Military, and AI Research in North America.
- Mon 15 Jun, 16:09 UTC. Google Cloud, its first report on the story. Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs.
- Mon 15 Jun, 16:50 UTC. Dark Reading, its first report on the story. China-Nexus Actor Spied on US Researchers Undetected for a Year. This article, 3rd of 7.
- Tue 16 Jun, 08:50 UTC. Security Affairs, its first report on the story. Chinese hackers stole data from US medical networks for two years.
- Thu 18 Jun, 17:20 UTC. SecurityWeek. Outdated REDCap servers expose research to China linked hackers.
- Mon 22 Jun, 13:22 UTC. SecurityOnline, its first report on the story. Google Uncovers UNC6508 Cyber Espionage Campaign.
- Tue 8 Sep, 12:07 UTC. Infosecurity, its first report on the story. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Mon 15 JunDay 03
- Chinese Hackers Target Medical, Military, and AI Research in North America14:20 · SecurityWeek · First report
- Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs16:09 · Google Cloud
- China-Nexus Actor Spied on US Researchers Undetected for a Year16:50 · Dark Reading · This article, 3rd of 7
- Tue 16 JunDay 11
- Chinese hackers stole data from US medical networks for two years08:50 · Security Affairs
Quiet for 2 days
Thu 18 JunDay 31- Outdated REDCap servers expose research to China linked hackers17:20 · SecurityWeek · Picked up again
Quiet for 4 days
Mon 22 JunDay 71- Google Uncovers UNC6508 Cyber Espionage Campaign13:22 · SecurityOnline · Picked up again
Quiet for 11 weeks
Tue 8 SepDay 851- Google Warns AI Coding Tools Fuel Software Supply Chain Attacks12:07 · Infosecurity · Picked up again