Loading threat actor…
UNC6508 is a PRC-nexus cyber espionage threat cluster active since at least 2023 and attributed with high confidence to intelligence collection aligned with the strategic interests of the People’s Republic of China. The actor has targeted North American academic, medical, military, and broader research-related organizations, including clinical providers, academic centers, military health institutions, advocacy groups, regulatory bodies, and other entities connected to sensitive research and national security topics. UNC6508 is notable for repeatedly targeting externally accessible REDCap deployments, particularly legacy or vulnerable versions running alongside newer installations. In observed intrusions, the actor compromised public-facing web applications, established persistence with a web shell, harvested database and service-account credentials, and later deployed custom malware known as INFINITERED. INFINITERED is tailored for REDCap environments and combines persistence, credential theft, and backdoor functionality. It survives software upgrades by intercepting the REDCap update process and reinserting malicious code into legitimate files, while also capturing usernames and passwords submitted through REDCap login workflows. After obtaining credentials, UNC6508 conducted internal reconnaissance, moved laterally into victim networks, and escalated access to privileged administrative accounts. The actor then abused legitimate enterprise administrative controls for covert collection, most notably by creating domain-level content compliance rules to silently copy targeted emails matching strategic keywords tied to defense, geopolitics, advanced technology, cyber programs, uncrewed systems, and medical research. This use of email compliance rules for espionage-grade exfiltration has been highlighted as a particularly unusual tradecraft element among PRC-linked actors. UNC6508 has demonstrated strong operational security, including long dwell time, use of bespoke malware, reliance on compromised routers and residential proxy infrastructure for obfuscation, and covert exfiltration through legitimate services rather than noisy malware on mail systems. Known victimology and collection priorities indicate a dominant espionage mission focused on defense intelligence, Indo-Pacific military matters, artificial intelligence, offensive cyber capabilities, public health, and biomedical research.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
33 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
8 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-linked espionage cluster targeting academic, medical, and military organizations in North America via REDCap.
Compromised REDCap servers for credential theft and covert email exfiltration.
Cyberespionage campaign targeting legacy internet-facing REDCap servers at major medical, academic, and military research organizations in the US. The group hacked web-facing REDCap servers, harvested login credentials, later accessed internal networks, and exfiltrated data.
Espionage campaign targeting REDCap environments and associated institutions to collect medical research, artificial intelligence, defense intelligence, Indo-Pacific command operations, cyber offensive program information, uncrewed vehicle systems data, and viral disease research.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.