UNC6508, a PRC-nexus espionage actor, compromised externally facing REDCap research servers and deployed bespoke malware INFINITERED to harvest legitimate login credentials. After dwelling undetected for more than a year, the actor replayed harvested credentials to reach a domain administrator account, then abused Google Workspace content compliance rules to silently BCC-forward sensitive research and defense email to an actor-controlled mailbox — leaving no malware on the mail server and generating no anomalous network traffic. Activity spanned September 2023 through November 2025.
TA2026170UNC6508 is a People's Republic of China (PRC)-nexus espionage actor that targeted North American medical research, academic, military health, health regulatory, and defense organizations between September 2023 and November 2025. The actor's primary targets were externally facing REDCap (Research Electronic Data Capture) servers — the web platform hospitals and universities use to build and manage clinical research databases and surveys.
The attack chain begins with exploitation of vulnerable REDCap instances, followed by deployment of INFINITERED — a bespoke, REDCap-specific implant that trojanizes the server's own system files to harvest credentials and persist through software upgrades. After dwelling for more than a year, UNC6508 replayed harvested credentials to pivot laterally to a domain administrator account, then created a Google Workspace content compliance rule to silently BCC-forward matching email to an attacker-controlled mailbox. The technique abused a legitimate admin feature, producing no mail-server malware, no separate exfiltration tool, and no anomalous network traffic — making detection extremely difficult.
Five stages cover the UNC6508 intrusion chain: REDCap initial access, INFINITERED deployment, backdoor capabilities, credential replay and lateral movement, and Google Workspace mail exfiltration.
| Type | Value |
|---|---|
| GUID Delimiter | b49e334d-9c01-463e-9bc5-00a6920fb66e |
| Session ID Prefix | xc32038474a |
| Email (defanged) | BebitaBarefoot774[@]gmail[.]com |
| IPv4 | 23[.]169[.]65[.]49 |
| SHA256 |
ba6b73b0ca0dc7f86b3b397893ac32d729fd53f9df20643288f141f29d020af7 db65c1b9f9e4cb4d729f45ad4b6fcf3e277caf9eb4c875425dec93fd883f9136 c1ac43d23f89d41eb4ff131678ab562ab2cfed9aa334b13767ef141d303b0e5b 8f0158855a656b629ca76ebca565f18bc25563ded34b65d6771632c20edb68ec 51a57bfc9ed3eb6451c1c289607814d59e1698c666fb97ac5f694c398f23d045 4efbef69eb3b09bacff892d6a55778d07c418e7f15eba3cf1245e8cdfd8dda0b 58bb25777e0aa86bcd2125101e0bca4e8732b03d91bd8d2f205b446a2a8d5c86 |
| Mail Rule Name | Patroit (misspelled — Google Workspace content compliance rule used for BCC exfiltration) |
| Tactic | Technique | Sub-technique & Notes |
|---|---|---|
| Initial Access | T1190 |
Exploit Public-Facing Application — externally facing REDCap servers probed for vulnerable legacy versions; downgrade attacks against older releases running alongside current builds |
| Execution | T1059 |
Command and Scripting Interpreter — INFINITERED backdoor executes shell commands received via HTTP cookie C2 on every REDCap page load |
| Persistence | T1505 |
T1505.003 Web Shell — INFINITERED trojanizes REDCap system files; upgrade-interception module reinjects malicious code into each new REDCap version rather than being cleared |
| Persistence | T1554 |
Compromise Host Software Binary — INFINITERED hijacks the REDCap upgrade process so software updates preserve and reinject the implant |
| Credential Access | T1056 |
T1056.003 Web Portal Capture — INFINITERED credential harvester captures usernames and passwords submitted via REDCap login pages; stores encrypted records in local database tables |
| Discovery | T1087 |
Account Discovery — database and service-account credentials pulled from the compromised REDCap environment to identify targets for lateral movement |
| Lateral Movement | T1021 |
Remote Services — harvested credentials replayed to move from the REDCap server into internal network; ultimately reaching a domain administrator account |
| Priv Escalation | T1078 |
Valid Accounts — harvested and replayed credentials used to authenticate as domain administrator without brute force or exploitation |
| Collection | T1074 |
T1074.001 Local Data Staging — harvested credentials stored encrypted in local REDCap database tables pending retrieval via backdoor |
| Collection | T1114 |
T1114.003 Email Forwarding Rule — Google Workspace content compliance rule "Patroit" silently BCC'd ~150-keyword-matched research and defense email to actor-controlled mailbox |
| Collection | T1213 |
Data from Information Repositories — REDCap clinical research databases and SQL-accessible data collected via INFINITERED backdoor's arbitrary SQL query capability |
| C2 | T1071 |
T1071.001 Web Protocols — INFINITERED backdoor receives commands embedded in HTTP cookies on every REDCap page load; blends with legitimate web traffic |
| C2 | T1090 |
T1090.002 External Proxy — actor-controlled infrastructure used as proxy for C2 communications |
| Exfiltration | T1567 |
Exfiltration Over Web Service — matching email silently BCC'd to attacker Gmail address via Google Workspace compliance rule; no anomalous network traffic generated |
| Defense Evasion | T1027 |
Obfuscated Files or Information — INFINITERED stores harvested credentials encrypted in REDCap database tables; payload obfuscated within legitimate REDCap system files |
