China-Nexus Actor Spy on US Researchers Undetected for a Year

Google Threat Intelligence Group and Mandiant uncovered and disrupted UNC6508, a China-aligned APT that covertly spied on US academic, medical, and military research organizations from at least September 2023 through November 2025. The actor exploited externally facing REDCap servers, deployed a custom credential-stealing malware called Infinitered tailored to REDCap, escalated to domain administrator access, and used a novel content-compliance rule method to forward sensitive emails to actor-controlled accounts; the campaign used US-based IP infrastructure for obfuscation. GTIG and Mandiant notified affected organizations, provided IOCs, and recommended enforcing phishing-resistant MFA, monitoring audit logs, enabling DLP, and patching systems.