A China-linked espionage campaign has breached exposed REDCap servers at a medical institution in North America, deploying the InfiniteRed malware to steal sensitive research data. The activity, tracked by Google's Threat Intelligence Group as UNC6508 since early 2025, specifically targeted medical, military, and AI research.
The attackers exploited misconfigured REDCap—a widely used electronic data capture platform for clinical and academic research—to gain initial access. Once inside, they deployed the custom InfiniteRed backdoor, enabling persistent data exfiltration. SecurityWeek reports the UNC6508 campaign has been active since early 2025, though the duration of the REDCap-specific breaches remains unclear.
BleepingComputer states the stolen data includes medical research and potentially sensitive patient information, though no specific volume of compromised records has been disclosed. The campaign's focus suggests the attackers prioritized long-term intelligence gathering over immediate disruption.
No patches or specific mitigations have been announced for REDCap itself. Organizations are advised to audit exposed REDCap instances, enforce network segmentation, and monitor for indicators of compromise associated with InfiniteRed. Google's Threat Intelligence Group continues to track the group's evolving tactics.
Attribution to China-aligned actors aligns with broader patterns of state-sponsored cyberespionage targeting healthcare and research sectors. The campaign underscores the vulnerability of academic and medical platforms that prioritize collaboration over strict access controls.