Google’s Threat Intelligence Group has disrupted a China-nexus espionage campaign that hid inside North American medical and military research networks for more than a year. The threat actor, tracked as UNC6508, abused legitimate Google Workspace content compliance rules to silently copy sensitive emails to attacker-controlled accounts.
What Happened: UNC6508 Espionage Campaign Targets US Medical and Defense Research
Google’s Threat Intelligence Group (GTIG) published a detailed report this week exposing UNC6508. The group operates with high confidence as a People’s Republic of China (PRC) threat actor. It compromised externally facing REDCap servers to gain initial access. Then it deployed custom malware called INFINITERED to harvest credentials and maintain persistence.
The campaign ran from September 2023 through November 2025. Victims included clinical providers, academic centers, military health institutions, advocacy groups, and health regulators across the United States and Canada. The threat actor had broad collection goals. It targeted artificial intelligence research, cyber offensive programs, uncrewed vehicle systems, Indo-Pacific command operations, and medical discovery data.
Google says it notified affected organizations and disrupted the malicious infrastructure. GTIG also updated Google Security Operations with indicators of compromise to help defenders detect this activity.
Technical Details of the UNC6508 Espionage Campaign
Initial Access via REDCap
The entry point was externally facing REDCap servers. REDCap is a web platform that hospitals and universities use to build and manage research databases. UNC6508 compromised these servers to gain a foothold.
Google did not identify a specific CVE or version for the initial access. However, the group was observed probing older, vulnerable REDCap instances. Therefore, organizations running outdated versions face elevated risk.
INFINITERED Malware Deployment
Approximately three months after initial access, UNC6508 deployed INFINITERED. This custom malware trojanizes REDCap system files and performs three core functions.
- Persistent reinjection: It hijacks the REDCap upgrade process so each new version reinstalls the malware instead of removing it.
- Credential harvesting: It captures usernames and passwords from the login page and stores them encrypted in local database tables.
- Backdoor access: It receives commands through HTTP cookies and executes on every page load.
Lateral Movement and Privilege Escalation
After deploying INFINITERED, UNC6508 conducted internal reconnaissance. It pulled database credentials and service account passwords. Then it used these credentials to move laterally across the network. The group eventually compromised a domain administrator account.
Google Workspace Content Compliance Abuse
The exfiltration technique was notably novel. UNC6508 abused a legitimate Google Workspace admin feature called content compliance rules. These rules scan mail for keywords and can copy or forward matching messages.
The threat actor created a rule with nearly 150 keywords, search terms, and email addresses. When a message matched, Google Workspace silently BCC’d it to an attacker-controlled Gmail address. No malware ran on the mail server. No unusual network traffic appeared. The exfiltration rode a built-in feature that most security tools do not flag.
Google has since disabled the attacker-controlled Gmail address. The technique demonstrates how cloud-native features can become covert exfiltration channels when admin credentials are compromised.
Business and Operational Impact
The UNC6508 campaign carries significant implications for healthcare, academia, and defense organizations. The targeted institutions employ thousands of people and hold combined research budgets in the billions. The stolen data spans national security, public health, and competitive intellectual property.
- National Security Risk: Military health institutions and defense research were direct targets. Stolen Indo-Pacific command and uncrewed vehicle data could aid foreign military planning.
- Medical Research Theft: Clinical trial data, molecular discovery, and drug development information were exfiltrated. This undermines years of investment and competitive advantage.
- Regulatory Exposure: Healthcare organizations face HIPAA and data protection obligations. A breach of this magnitude triggers mandatory reporting and potential penalties.
- Trust Erosion: Patients, research participants, and funding agencies may lose confidence in institutions that cannot protect sensitive data.
- Supply Chain Risk: REDCap is widely deployed across research institutions. A single compromised instance can cascade into multiple organizational breaches.
Mitigation and Recommendations
Immediate Actions for Defenders
- Audit all Google Workspace content compliance rules. Remove any rules that BCC or forward mail to external addresses without explicit business justification.
- Review REDCap server logs for signs of INFINITERED. Look for suspicious file modifications, unexpected database tables storing encrypted credentials, and anomalous HTTP cookie patterns.
- Enforce phishing-resistant two-step verification on all enterprise administrator accounts. This includes accounts managed through third-party identity providers.
- Rotate all domain administrator credentials if your organization runs REDCap or was notified by Google.
- Inspect Google Workspace audit logs for rule creation events, especially those made by admin accounts around the September 2023 to November 2025 timeframe.
Additional Guidance
Organizations using REDCap should apply the latest patches immediately. Furthermore, restrict external network access to REDCap instances to VPN or trusted IP ranges. Monitor for probing activity against older REDCap versions.
Google recommends enrolling highly sensitive accounts in its Advanced Protection Program for additional safeguards against malware and phishing. Also, enforce Device Bound Session Credentials to prevent cookie theft and replay attacks.
Bottom line: UNC6508 demonstrates that cloud-native admin features can become silent exfiltration channels when credentials are compromised. Audit your Google Workspace rules today, patch REDCap, and enforce phishing-resistant MFA on every admin account.
Incident Summary
| Threat Actor: | UNC6508 (PRC-nexus, also linked to Earth Lusca / FishMonger) |
| Campaign Duration: | September 2023 to November 2025 |
| Target Sector: | Medical, academic, military health, and defense research institutions in the US and Canada |
| Initial Access: | Externally facing REDCap servers |
| Malware: | INFINITERED (custom REDCap trojan) |
| Exfiltration Method: | Abuse of Google Workspace content compliance rules |
| Disclosure Date: | June 15, 2026 |
| Patch Status: | REDCap organizations should update to the latest version; no single CVE identified for initial access |
References
- Google Threat Intelligence Group, “Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research,” Google Cloud Blog, June 15, 2026, https://cloud.google.com/blog/topics/threat-intelligence/prc-targets-us-medical-research, accessed June 16, 2026.
- The Hacker News, “Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails,” June 15, 2026, https://thehackernews.com/2026/06/chinese-hackers-abused-google-workspace.html, accessed June 16, 2026.
- Project REDCap, “REDCap Secure Configuration Guide,” Vanderbilt University, https://www.project-redcap.org/, accessed June 16, 2026.
