Chinese hackers breached North American research institutions via REDCap servers

UNC6508, a China-linked APT, exploited legacy REDCap servers across North American medical research institutions (Sept 2023–Nov 2025) to deploy INFINITERED — a trojanized, modular payload that intercepts upgrades, harvests credentials via the application, and provides an HTTP-cookie backdoor; attackers later used harvested admin credentials to create a "Patroit" email compliance rule that forwarded targeted messages to a Gmail account. Google identified multiple US/Canadian victims, disrupted associated infrastructure, published IoCs/YARA rules, and advised upgrading REDCap and enforcing 2-step verification.