TLDR Tech / InfoSec
China-Nexus Actor Spies on US Researchers Undetected for a Year
Google's GTIG and Mandiant attributed a year-plus espionage campaign against US medical, academic, and military research institutions to a new China-aligned actor, UNC6508, which used REDCap-specific malware named Infinitered to harvest credentials, then exfiltrated email by abusing domain content-compliance rules rather than malware or living-off-the-land tools. What stands out is the tradecraft signaling a maturation in PRC-nexus operations: an unusually broad collection scope at a single site, malware reverse-engineered to run only on REDCap servers, and an obfuscation network built exclusively from US-based IPs to blend in with normal logins. The episode reframes detection priorities around identity and configuration drift rather than payloads, since the most evasive stage left almost no conventional endpoint or network footprint.
Read the full story