Chinese hackers breach REDCap servers, steal medical research

A China-linked APT (UNC6508) targeted exposed REDCap instances at medical research organizations in North America, deploying the custom Infinitered malware (persistence/update module, credential harvester, backdoor) to capture credentials, execute commands, run SQL, and exfiltrate sensitive research. The actor abused cloud 'content compliance' email rules to automatically BCC matched data to an external account, trojanized system files to hide components, used high operational security (proxies, compromised routers, dedicated exfiltration infrastructure), and remained undetected for over a year; GTIG published YARA rules and IoCs and recommended patching REDCap, enabling MFA/DBSC, and removing legacy instances.