Google exposes China espionage group that’s been lurking in networks undetected since 2023

### Executive summary Google Threat Intelligence Group disclosed UNC6508, a previously unknown Chinese state-linked espionage group that used a custom backdoor (INFINITERED) and exploited externally facing REDCap servers to steal credentials and sensitive data from U.S. and Canadian clinical providers, academic medical centers and military health institutions; the activity spanned from at least September 2023 to November 2025 and remained largely undetected, with evidence of traffic routing through U.S. IPs and exfiltration via a Gmail account.