SecurityWeekEduard Kovacs
Chinese Hackers Target Medical, Military, and AI Research in North America
Part of the UNC6508 story · since 15 Jun
- Mon 15 Jun, 14:20 UTC. SecurityWeek, first report. Chinese Hackers Target Medical, Military, and AI Research in North America. This article, 1st of 7.
- Mon 15 Jun, 16:09 UTC. Google Cloud, its first report on the story. Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs.
- Mon 15 Jun, 16:50 UTC. Dark Reading, its first report on the story. China-Nexus Actor Spied on US Researchers Undetected for a Year.
- Tue 16 Jun, 08:50 UTC. Security Affairs, its first report on the story. Chinese hackers stole data from US medical networks for two years.
- Thu 18 Jun, 17:20 UTC. SecurityWeek. Outdated REDCap servers expose research to China linked hackers.
- Mon 22 Jun, 13:22 UTC. SecurityOnline, its first report on the story. Google Uncovers UNC6508 Cyber Espionage Campaign.
- Tue 8 Sep, 12:07 UTC. Infosecurity, its first report on the story. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks.
The Google Threat Intelligence Group (GTIG) reported on cyberespionage activities of a group associated with the Chinese government, identified as UNC6508, which has been active since at least 2023. This group mainly targets North American medical, academic, and military research organizations, including those involved in clinical trials and public health policy. Their attacks often exploit vulnerabilities in REDCap servers used for clinical research.
The group uses sophisticated malware called InfiniteRed to facilitate operations, including credential harvesting and maintaining backdoors. They also utilize obfuscation techniques to conceal their activities. Google has disrupted the group’s infrastructure and shared technical details to aid defense against such threats.
How the story developed
7 articles from 6 outlets since 15 Jun. Quiet since 8 Sep. This was the first report.
- Mon 15 Jun, 14:20 UTC. SecurityWeek, first report. Chinese Hackers Target Medical, Military, and AI Research in North America. This article, 1st of 7.
- Mon 15 Jun, 16:09 UTC. Google Cloud, its first report on the story. Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs.
- Mon 15 Jun, 16:50 UTC. Dark Reading, its first report on the story. China-Nexus Actor Spied on US Researchers Undetected for a Year.
- Tue 16 Jun, 08:50 UTC. Security Affairs, its first report on the story. Chinese hackers stole data from US medical networks for two years.
- Thu 18 Jun, 17:20 UTC. SecurityWeek. Outdated REDCap servers expose research to China linked hackers.
- Mon 22 Jun, 13:22 UTC. SecurityOnline, its first report on the story. Google Uncovers UNC6508 Cyber Espionage Campaign.
- Tue 8 Sep, 12:07 UTC. Infosecurity, its first report on the story. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Mon 15 JunDay 03
- Chinese Hackers Target Medical, Military, and AI Research in North America14:20 · SecurityWeek · First report · This article, 1st of 7
- Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs16:09 · Google Cloud
- China-Nexus Actor Spied on US Researchers Undetected for a Year16:50 · Dark Reading
- Tue 16 JunDay 11
- Chinese hackers stole data from US medical networks for two years08:50 · Security Affairs
Quiet for 2 days
Thu 18 JunDay 31- Outdated REDCap servers expose research to China linked hackers17:20 · SecurityWeek · Picked up again
Quiet for 4 days
Mon 22 JunDay 71- Google Uncovers UNC6508 Cyber Espionage Campaign13:22 · SecurityOnline · Picked up again
Quiet for 11 weeks
Tue 8 SepDay 851- Google Warns AI Coding Tools Fuel Software Supply Chain Attacks12:07 · Infosecurity · Picked up again