✨ The Containment Era is here. →Explore ✨

aviatrix logoAviatrix
Under Active Attack

Executive Summary

Between September 2023 and November 2025, the Chinese state-sponsored group UNC6508 infiltrated vulnerable REDCap servers at a North American medical research institution. They deployed custom malware named Infinitered, which harvested credentials and established a backdoor, enabling prolonged data exfiltration. The attackers exploited REDCap's widespread use in medical research to access sensitive information undetected for over a year.

This incident underscores the persistent threat posed by nation-state actors targeting critical research sectors. The sophisticated methods employed, including the abuse of legitimate features for data exfiltration, highlight the evolving tactics in cyberespionage campaigns.

Why This Matters Now

The UNC6508 breach highlights the urgent need for organizations to secure widely-used platforms like REDCap, as attackers increasingly exploit such tools to access sensitive data. The prolonged undetected access emphasizes the importance of robust monitoring and timely patching to defend against sophisticated cyberespionage threats.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

UNC6508 is a Chinese state-sponsored cyberespionage group known for targeting medical and research institutions to steal sensitive data.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attacker's ability to move laterally, escalate privileges, and exfiltrate data by enforcing strict segmentation and identity-based access controls.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The attacker's initial access may have been limited to the compromised server, reducing the potential for further exploitation.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: The attacker's ability to escalate privileges could have been constrained, reducing the risk of unauthorized access to sensitive systems.

Lateral Movement

Control: East-West Traffic Security

Mitigation: The attacker's lateral movement within the network could have been restricted, limiting access to additional systems.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: The attacker's ability to establish and maintain command and control channels may have been disrupted, reducing the effectiveness of the backdoor.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: The attacker's data exfiltration efforts could have been hindered, reducing the risk of sensitive information being transmitted to external destinations.

Impact (Mitigations)

The attacker's prolonged access to compromised systems could have been limited, reducing the potential impact on sensitive research data.

Impact at a Glance

Affected Business Functions

  • Clinical Data Management
  • Research Data Analysis
  • Regulatory Compliance Reporting
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Sensitive medical research data, including clinical trial results and patient information.

Recommended Actions

  • • Implement Zero Trust Segmentation to restrict lateral movement within the network.
  • • Deploy East-West Traffic Security controls to monitor and control internal traffic flows.
  • • Utilize Multicloud Visibility & Control to detect and respond to anomalous activities across cloud environments.
  • • Enforce Egress Security & Policy Enforcement to prevent unauthorized data exfiltration.
  • • Regularly update and patch REDCap servers to mitigate known vulnerabilities.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image