A China-linked espionage group infiltrated medical, academic, and military research networks across North America for over a year, quietly stealing sensitive research and defense-related emails.
The entry point was a backdoor on their REDCap research servers that captured login credentials. The data theft method was unusual: the attackers modified the victims' own Google Workspace rules to automatically copy any emails matching their search terms to an inbox they controlled.
Google's Threat Intelligence Group (GTIG) detailed the operation in a report released this week, attributing it with high confidence to a cluster it monitors as UNC6508.
The group and its REDCap backdoor are not unfamiliar; Google first disclosed both in February, as part of a broader report on state-sponsored attacks targeting the defense sector. It did not identify the victims, describing them only as multiple entities across the United States and Canada, including clinical providers, academic institutions, military health organizations, advocacy groups, and health regulators.
Google stated that it notified the affected parties and dismantled the group's infrastructure.
How they gained access
The entry point was REDCap (Research Electronic Data Capture), a web platform used by hospitals and universities to create and manage research databases. UNC6508 compromised externally facing REDCap servers.
Google has not identified the specific initial access vector, named a particular CVE, or listed the affected versions, though it observed the group probing older, vulnerable ones.
Approximately three months after gaining entry, the group deployed custom malware that GTIG calls INFINITERED, which infects REDCap's own system files and performs three functions.
First, it hijacks the upgrade process, ensuring that each new REDCap version reinserts the code rather than removing it.
Second, it captures usernames and passwords from the login page and stores them, encrypted, in local database tables.
Third, it functions as a backdoor, receiving commands through HTTP cookies and executing on every page load.
The earliest known compromise dates back to September 2023, with activity continuing through November 2025. Once on the server, UNC6508 conducted internal reconnaissance and credential discovery, extracting database and service account credentials, then used those logins to move into the internal network and eventually to a domain administrator account.
Google does not detail the exact path to that admin account. With admin privileges, the group set up the data theft operation.
How they stole the emails
The data theft exploited an existing feature. UNC6508 abused content compliance rules, a legitimate Google Workspace admin feature that scans emails for keywords and can copy or forward matching messages.
Similar features exist in other cloud email suites. The group created a rule, misspelled as "Patroit," that monitored for nearly 150 keywords, search terms, and email addresses. When a message matched, Workspace silently BCC'd it to an attacker-controlled Gmail address, which Google has since disabled. No malware on the mail server, no separate exfiltration tool, no unusual network traffic. Just a built-in email feature, turned to copy the organization's secrets to an inbox the attackers owned.
MITRE already lists email forwarding rule abuse as a known technique. What GTIG highlights as new here is the use of domain content compliance rules to achieve this, a method it says it had not previously observed from a China-linked actor.
The rule's keywords reflected UNC6508's collection priorities: geo-strategic policy, military strategy and equipment, advanced technology including AI and unmanned vehicles, offensive cyber programs, and medical research. One term stood out for its specificity, chikungunya, the mosquito-borne virus behind a 2025 outbreak in China's Guangdong province.
What to do
Start with REDCap. Patch externally facing servers and remove old versions entirely, not just alongside the current build. REDCap allows legacy versions to run concurrently, and this enables downgrade attacks, where an attacker forces software back to a known-vulnerable version.
Then check the email side. Review Workspace, or equivalent, content compliance and email forwarding rules for anything that BCCs or reroutes mail to external addresses. Check admin audit logs for when rules changed, not just what they currently show. Pull GTIG's published indicators and search for INFINITERED. And deploy phishing-resistant MFA on administrator accounts, since the entire email theft step relied on admin access.
Google still does not know how UNC6508 initially reached the REDCap servers. The part worth monitoring is the email rule. Once attackers hold admin access, a built-in cloud feature can quietly become an exfiltration path, and that is what defenders need to audit, not just the REDCap backdoor.