UNC6508 Spent a Year Inside US and Canadian Research Networks via Trojanized REDCap
A China-linked espionage group hijacked REDCap's own upgrade process to plant persistent malware across academic, medical, and defense-adjacent research environments.
Google's Threat Intelligence Group (GTIG) has published findings on UNC6508, a China-nexus actor that spent more than twelve months quietly embedded in research institutions across the United States and Canada. The vector was REDCap — a widely deployed platform for collecting and managing research data — and the method was patient, systematic, and hard to spot without file-integrity monitoring.
UNC6508 targeted academic institutions, medical research centers, healthcare providers, military health networks, and defense-focused research programs. The data of interest spanned national security, AI development, cyber operations, and medical research. Sensitive, by any measure.
The malware family GTIG tracks as INFINITERED does something clever. It doesn't just drop a backdoor. It embeds itself into REDCap's upgrade workflow, ensuring it survives software updates. INFINITERED has three components: a dropper that intercepts the upgrade process and reinjects malicious logic, a credential harvester injected into REDCap's authentication system file, and a backdoor written into the custom hooks configuration file.
The upgrade interception module is the linchpin. REDCap permits administrators to run legacy versions alongside current installations. UNC6508 exploited that design choice: the actor first infected older legacy instances through an initial access method GTIG could not confirm, then used those infected legacy files as a reservoir. When administrators ran upgrades, the malicious logic transferred forward.
That's a supply-chain-style persistence trick without touching the supply chain.
Post-compromise activity included internal reconnaissance, database credential harvesting, and deployment of a web shell named help.php, which served as both a persistence mechanism and a file uploader inside the REDCap application. The backdoor supports remote file management, shell command execution, and system enumeration.
GTIG notified affected organizations across both countries and offered remediation assistance.
What affected organizations should do
GTIG released a YARA rule for hunting INFINITERED. Organizations running REDCap should treat it as the starting point, not the finish line. Four concrete steps matter here:
- Audit REDCap application files for unauthorized modifications, paying particular attention to authentication system files and custom hooks configuration files.
- Identify and either remove or isolate any legacy REDCap versions still accessible alongside current deployments.
- Validate file integrity both before and after any upgrade cycle going forward.
- Enforce phishing-resistant multi-factor authentication and device-bound session credentials for all REDCap administrative accounts.
REDCap's maintainers have not issued a public advisory as of publication.
