UNC6508 Cyberespionage Campaign Targets US and Canadian Research Institutions

Google’s Threat Intelligence Group reported that a Chinese-linked hacking collective, designated UNC6508, conducted a covert operation against U.S. and Canadian academic, medical and military research facilities, targeting data of strategic importance. The intrusion spanned September 2023 to November 2025 and was uncovered in June 2026.

The Straits Times

UNC6508’s methods mirrored long-standing Chinese-linked intrusion techniques. The campaign began by exploiting vulnerabilities in REDCap, a survey platform used by many nonprofits. Attackers stole valid REDCap credentials, installed custom malware, and configured email forwarding for roughly 150 targeted keywords to a Gmail account they controlled. Activity persisted through 2025 before Google’s detection in mid-2026.

Reuters

• UNC6508 – the Chinese-linked hacking group.

The Straits Times

• Google Threat Intelligence Group – the security team that uncovered the operation.

The Straits Times

• Luke McNamara – Deputy Chief Analyst, Google Threat Intelligence Group.

Reuters

• Chinese Embassy in Washington – contacted for comment but did not respond.

Reuters

• REDCap – the vulnerable survey application exploited in the initial breach.

Reuters

The compromised institutions span academic, medical and defence research, employing thousands of staff and managing budgets in the billions of dollars. Hackers sought defence intelligence, Indo-Pacific military strategy, artificial intelligence, unmanned systems, cyber-warfare programmes and medical research. Approximately 150 keywords captured phone numbers, email addresses and terms tied to geo-strategic policy, advanced technology and health studies, covering areas such as drug discovery, clinical trials, public-health policy and military readiness.

Reuters

Google attributed the operation to UNC6508, noting alignment with known Chinese-linked tactics, and said it individually notified each affected organization of the breach. The Chinese Embassy offered no comment; Beijing regularly denies involvement in illicit hacking activities.

The Straits Times

Observers criticize the lack of transparency from Beijing and warn that the embassy’s silence may mask state-sponsored cyber activity, especially given Beijing’s regular denial of illicit hacking.

The Straits Times

Google did not disclose the names or exact number of compromised entities, and independent verification of the breach remains unavailable, leaving a gap in public understanding of the campaign’s full scope.

The Straits Times

• “A Chinese-linked hacking group spent more than a year secretly stealing data from US and Canadian academic, medical and military research institutions, before being detected, Google said on June 15.” — Google (Reuters)

The Straits Times

• “Luke McNamara, deputy chief analyst at Google Threat Intelligence Group, said the organisation's methods are broadly consistent with Chinese-linked hacking activity seen over many years, focused on gathering information likely to be of interest to the Chinese government.” — Luke McNamara, Deputy Chief Analyst, Google Threat Intelligence Group

The Straits Times

• “The earliest known activity tied to the campaign dates to September 2023, when the hackers exploited vulnerabilities in servers running REDCap, a web application widely used by nonprofits to build and manage online surveys and databases.” — Google Threat Intelligence Group

The Straits Times

• “Google eventually identified multiple compromised organisations across the US and Canada and notified each of them, the researchers said.” — Google Threat Intelligence Group

The Straits Times

Google will keep monitoring the networks, share indicators with allies, and issue guidance on securing REDCap deployments, including stronger credential-management practices and regular patching.

The Straits Times