SecurityWeekIonut Arghire
Outdated REDCap servers expose research to China linked hackers
Part of the UNC6508 story · since 15 Jun
- Mon 15 Jun, 14:20 UTC. SecurityWeek, first report. Chinese Hackers Target Medical, Military, and AI Research in North America.
- Mon 15 Jun, 16:09 UTC. Google Cloud, its first report on the story. Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs.
- Mon 15 Jun, 16:50 UTC. Dark Reading, its first report on the story. China-Nexus Actor Spied on US Researchers Undetected for a Year.
- Tue 16 Jun, 08:50 UTC. Security Affairs, its first report on the story. Chinese hackers stole data from US medical networks for two years.
- Thu 18 Jun, 17:20 UTC. SecurityWeek. Outdated REDCap servers expose research to China linked hackers. This article, 5th of 7.
- Mon 22 Jun, 13:22 UTC. SecurityOnline, its first report on the story. Google Uncovers UNC6508 Cyber Espionage Campaign.
- Tue 8 Sep, 12:07 UTC. Infosecurity, its first report on the story. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks.
A report by Censys indicates that most internet-accessible REDCap servers are outdated and vulnerable to attacks, particularly from state-sponsored actors like the China-linked group UNC6508. REDCap, a web-based platform used in medical research, is particularly targeted for cyberespionage, with UNC6508 successfully hacking into multiple legacy servers. Less than 1% of the approximately 8,500 exposed REDCap instances are updated to the latest software version.
Nearly 30% are running a version deemed outdated, which increases their risk of being compromised. Organizations using REDCap are advised to ensure their systems are up-to-date and to follow security best practices, such as separating web and database servers.
How the story developed
7 articles from 6 outlets since 15 Jun. Quiet since 8 Sep. This was the 5th report, 3 days after the first.
- Mon 15 Jun, 14:20 UTC. SecurityWeek, first report. Chinese Hackers Target Medical, Military, and AI Research in North America.
- Mon 15 Jun, 16:09 UTC. Google Cloud, its first report on the story. Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs.
- Mon 15 Jun, 16:50 UTC. Dark Reading, its first report on the story. China-Nexus Actor Spied on US Researchers Undetected for a Year.
- Tue 16 Jun, 08:50 UTC. Security Affairs, its first report on the story. Chinese hackers stole data from US medical networks for two years.
- Thu 18 Jun, 17:20 UTC. SecurityWeek. Outdated REDCap servers expose research to China linked hackers. This article, 5th of 7.
- Mon 22 Jun, 13:22 UTC. SecurityOnline, its first report on the story. Google Uncovers UNC6508 Cyber Espionage Campaign.
- Tue 8 Sep, 12:07 UTC. Infosecurity, its first report on the story. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 7 articles as a listHide the list
- Mon 15 JunDay 03
- Chinese Hackers Target Medical, Military, and AI Research in North America14:20 · SecurityWeek · First report
- Chinese Hackers Use REDCap Flaw to Spy on US Universities and Labs16:09 · Google Cloud
- China-Nexus Actor Spied on US Researchers Undetected for a Year16:50 · Dark Reading
- Tue 16 JunDay 11
- Chinese hackers stole data from US medical networks for two years08:50 · Security Affairs
Quiet for 2 days
Thu 18 JunDay 31- Outdated REDCap servers expose research to China linked hackers17:20 · SecurityWeek · Picked up again · This article, 5th of 7
Quiet for 4 days
Mon 22 JunDay 71- Google Uncovers UNC6508 Cyber Espionage Campaign13:22 · SecurityOnline · Picked up again
Quiet for 11 weeks
Tue 8 SepDay 851- Google Warns AI Coding Tools Fuel Software Supply Chain Attacks12:07 · Infosecurity · Picked up again