PRC-Nexus Hackers Abuse REDCap Servers to Monitor US Medical Research Organizations

A sophisticated, long-running cyberespionage campaign attributed to UNC6508, a People’s Republic of China (PRC)-nexus threat actor, that systematically targets North American academic, medical, and military research institutions.

The campaign, active since at least September 2023, remained undetected for over a year while the threat actor silently harvested credentials, exfiltrated sensitive communications, and maintained persistent access across victim networks spanning research into artificial intelligence, uncrewed vehicle systems, cyber offensive programs, national defense operations, and medical research.

The targeted organizations include world-renowned clinical providers, premier academic medical centers, North American military health institutions, professional advocacy bodies, and health regulatory agencies, collectively employing thousands of personnel and having combined research budgets in the billions of dollars.

GTIG, working alongside Mandiant Consulting and the FLARE team, disrupted the malicious infrastructure and notified affected organizations upon detection.

PRC-Nexus Hackers Abuse REDCap Servers

The campaign’s entry point was the deliberate targeting of REDCap (Research Electronic Data Capture) servers, a web-based platform widely used in North American medical and scientific research communities to build and manage online databases and surveys.

UNC6508 exploited externally facing REDCap servers, probing for vulnerable legacy software versions that administrators had left running alongside current installations, a permitted feature of REDCap’s design that the threat actor weaponized through downgrade attacks (MITRE ATT&CK: T1689).

Upon establishing a foothold, UNC6508 conducted internal reconnaissance and credential discovery and deployed a web shell named help.php to maintain persistent access and function as a file uploader within the REDCap application.

Three months after initial compromise, UNC6508 deployed a bespoke malware payload designated INFINITERED, a modular implant that trojans legitimate REDCap system files across three components: a Dropper/Upgrade Interceptor, a Credential Harvester, and a Backdoor with C2 capability.

The dropper intercepts REDCap’s own upgrade mechanism to re-inject INFINITERED into each new version installed, ensuring persistent remote access survives software updates.

The credential harvester injects into the authentication system file and silently captures usernames and passwords submitted via POST requests at login.

Stolen credentials are encrypted using the environment’s default encryption routine and stored in a legitimate REDCap sessions database table, prefixed with the string xc32038474a to blend in with normal session data.

The backdoor component activates on every page load, watching for a specific HTTP Cookie parameter named REDCAP-TOKEN. When the correct cookie is present, the malware decrypts its payload.

It executes commands, including arbitrary shell commands, raw SQL queries, and file transfers, providing the threat actor with deep, covert control over the compromised server.

Novel Email Exfiltration

More than a year after the initial breach, UNC6508 used the harvested REDCap credentials to pivot to a domain administrator account. The threat actor then abused a legitimate enterprise content compliance rule feature, a technique not previously observed with PRC-nexus actors, to create a rule named “Patroit” (a deliberate misspelling, suggesting manual list maintenance).

This rule used regular expressions to match on strategic keywords and email addresses, then silently BCC-forwarded matched communications to a threat actor-controlled Gmail address: BebitaBarefoot774[@]gmail[.]com.

The targeted collection categories spanned geostrategic policy, military strategy, advanced technology, and medical research, with notable attention to the pathogen Chikungunya.

This viral disease caused a significant outbreak in China’s Guangdong province beginning in July 2025. GTIG assessed the collection priorities as directly aligned with the PRC’s strategic intelligence requirements. Upon discovery, the exfiltration Gmail account was disabled.

UNC6508 demonstrated meticulous operations security (OpSec), routing all offensive traffic through US-based obfuscation (OBF) networks, a mix of compromised ASUS routers, residential proxies, and VPS infrastructure, to evade geographic-based detection.

The threat actor-controlled Gmail account was obtained through a mass-account-creation service and was dedicated exclusively to email exfiltration.

GTIG attributes this activity to UNC6508 with high confidence, based on infrastructure overlaps, consistent INFINITERED deployment patterns, and targeting aligned with historic PRC state-sponsored espionage interests.

Indicators of Compromise (IOCs)

Network Indicators

Indicator	Type	Context
BebitaBarefoot774[@]gmail[.]com	Email	Threat actor-controlled email exfiltration account
23.169.65.49	IP Address	Source of admin login (Compromised ASUS router)

---

File Indicators (SHA256 Hashes)

Description	SHA256 Hash
Persistence (help.php)	ba6b73b0ca0dc7f86b3b397893ac32d729fd53f9df20643288f141f29d020af7
Credential Harvester	db65c1b9f9e4cb4d729f45ad4b6fcf3e277caf9eb4c875425dec93fd883f9136
Credential Harvester	c1ac43d23f89d41eb4ff131678ab562ab2cfed9aa334b13767ef141d303b0e5b
Backdoor	8f0158855a656b629ca76ebca565f18bc25563ded34b65d6771632c20edb68ec
Backdoor	51a57bfc9ed3eb6451c1c289607814d59e1698c666fb97ac5f694c398f23d045
Dropper	4efbef69eb3b09bacff892d6a55778d07c418e7f15eba3cf1245e8cdfd8dda0b
Dropper	58bb25777e0aa86bcd2125101e0bca4e8732b03d91bd8d2f205b446a2a8d5c86

---

Host Indicators

Indicator	Description
b49e334d-9c01-463e-9bc5-00a6920fb66e	INFINITERED GUID delimiter used for upgrade interception
xc32038474a	INFINITERED REDCap session database prefix for stolen credentials

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.