Google Uncovers UNC6508 Cyber Espionage Campaign

Google Threat Intelligence Group attributes a large, long-running UNC6508 espionage campaign against North American academic, medical, and military research organizations to a suspected PRC-nexus actor; attackers exploited legacy REDCap instances to install INFINITERED — a custom credential-harvesting backdoor that intercepted updates, executed remote commands, and exfiltrated sensitive defense and pathogen research using a novel abuse of email content compliance rules, with infrastructure later disrupted by Google.