GoKawiilAn emerging China-nexus threat actor covertly spied on US academic, medical, and military research institutions for at least a year in a sweeping intelligence-gathering effort.
The campaign, uncovered by the Google Threat Intelligence Group (GTIG), relied on using custom malware to steal credentials from a Web application widely used by researchers, as well as a novel technique to stealthily transfer data out of an IT environment. GTIG, working with Google subsidiary Mandiant Consulting, discovered and subsequently disrupted the sprawling operation, which targeted the network of a single medical university with ties to the US military, but affected numerous organizations, according to a report published Monday.
Google attributed the campaign to a group tracked as UNC6508, a relatively new China-aligned threat actor aimed at pursuing intelligence objectives aligned with the strategic interests of the People's Republic of China (PRC) by targeting "a diverse set of national, state, and private medical entities," according to the report.
Related:China's TA4922 Expands Cybercrime Attacks Globally
Indeed, the organizations affected by the activity comprise world-renowned clinical providers, premier academic centers, North American military health institutions, professional advocacy groups, and health regulatory bodies, according to GTIG and Mandiant researchers.
"Their research areas span a broad spectrum of modern medicine, from molecular discovery and clinical drug trials to state-level public health policy and military readiness," the report stated. "They employ thousands of people with a combined research budget in the billions of dollars."
Surprising Scope for UNC6508
Patrick Whitsell, senior security engineer from GTIG, tells Dark Reading that despite the long and storied history of China-nexus threat actors conducting cyber espionage on US organizations, GTIG still found the scope of the intelligence-collection effort surprising. Indeed, while the activity "aligns with historical PRC intelligence objectives, the broad scope of their collection criteria at a single site was highly unusual," he says.
"The scope of attempted collection encompassed military strategy and programs, foreign policy, advanced defense technology, medical research, and companies in the defense industrial base," Whitsell says. "Typically we would expect to see a more focused collection tailored to the specific targeted organization."
GTIG discovered the earliest known activity of the intrusion in September 2023, with the threat actor exploiting the university's externally facing servers for REDCap (Research Electronic Data Capture), a Web application designed for clinical research. UNC6508 then deployed custom malware named Infinitered to capture credentials for REDCap, with malicious activity continuing consistently through November 2025.
... continue reading