UNC6508: Unveiling the Stealthy Chinese Espionage Group Targeting North American Research
In late 2025, Google's Threat Intelligence Group identified UNC6508, a Chinese state-sponsored espionage group, which had infiltrated U.S. and Canadian organizations since September 2023. The group exploited vulnerabilities in externally facing REDCap servers to deploy a custom backdoor named INFINITERED, enabling them to steal administrative credentials and sensitive data from medical research universities, clinical providers, and military health institutions. UNC6508 remained undetected for over two years, highlighting the sophistication and stealth of their operations. ([cyberscoop.com](https://cyberscoop.com/google-unc6508-china-espionage-threat/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber espionage groups targeting critical infrastructure and sensitive research sectors. The ability of such groups to operate undetected for extended periods emphasizes the need for enhanced cybersecurity measures and vigilance within organizations handling sensitive data. ([cyberscoop.com](https://cyberscoop.com/google-unc6508-china-espionage-threat/?utm_source=openai))
Kill Chain
