Chinese Hackers Target Medical, Military, and AI Research in North America

Why It Matters

The intrusion threatens sensitive health data, cutting‑edge AI research, and national security assets, prompting urgent defensive actions across the sector. It underscores the growing sophistication of state‑backed cyber‑espionage targeting critical research infrastructure.

Key Takeaways

• UNC6508 targets REDCap servers in US and Canada
• Malware InfiniteRed provides backdoor and credential harvesting capabilities
• Attackers exfiltrate emails via abused content compliance rules
• Campaign focuses on medical, AI, military and defense research
• Google disrupted infrastructure and released IoCs for defenders

Pulse Analysis

The emergence of UNC6508 reflects a broader trend of nation‑state actors leveraging specialized cyber tools to infiltrate high‑value research environments. First identified by Google in early 2025, the group has pursued a systematic campaign against North American institutions that house cutting‑edge medical trials, AI development labs, and defense research. By exploiting legacy versions of the REDCap platform—widely used for clinical data collection—the actors gain footholds that enable deeper penetration into networks that store sensitive patient information and proprietary scientific data.

Technical analysis reveals that the attackers deploy InfiniteRed, a modular malware suite capable of dropping additional payloads, intercepting upgrades, harvesting credentials, and maintaining persistent command‑and‑control channels. A notable tactic involves abusing Google Workspace's content compliance rules to silently siphon emails related to targeted topics, extending the espionage beyond the initial REDCap compromise. The use of obfuscation networks, bulk‑sourced accounts and legitimate credentials further masks their activity, complicating detection for traditional security tools.

For the U.S. and Canadian research ecosystem, the campaign raises alarm bells about the vulnerability of critical infrastructure that underpins public health, AI innovation, and national defense. Organizations must prioritize patching legacy systems, implementing zero‑trust architectures, and monitoring for anomalous email flow patterns. Google's release of indicators of compromise equips defenders with actionable intelligence, but sustained collaboration between industry, academia, and government agencies will be essential to mitigate the strategic risks posed by state‑sponsored cyber‑espionage.