Google Exposes China Espionage Group UNC6508 Lurking in Networks Since 2023

Google's Threat Intelligence Group disclosed UNC6508, a China-linked espionage cluster that implanted custom backdoors and maintained stealthy, long-term access (2023–2026) to critical infrastructure, research institutions, and government-adjacent networks; the report highlights attribution, persistence-focused TTPs (living-off-the-land, low-and-slow data exfiltration), the detection challenges that allowed three years of dwelling, and recommended mitigations such as zero-trust segmentation, behavioral analytics, proactive hunting, and comprehensive logging.