Jun 17 – June 19, 2026 · 3 reports
- Mandiant detailed PRC-nexus UNC6508 spending over two years inside North American medical/defense research networks via vulnerable REDCap servers, deploying INFINITERED malware and abusing enterprise admin tools for covert exfil (Mandiant, Security Affairs). · Jun 19 · observed · via exposed service · Nation-State & APT
- UNC6508 (PRC-nexus) lurked in North American medical, academic, and defense research networks for over a year, backdooring vulnerable REDCap servers with InfiniteRed malware and abusing the victims' own Google Workspace mail rules to silently copy outbound research and defense email (Mandiant/GTIG, The Hacker News). · Jun 18 · observed · Threat Activity & Ransomware
- UNC6508 (China-nexus) lived undetected in North American medical, AI, and defense research networks for over a year (Sep 2023–Nov 2025), exploiting vulnerable REDCap servers to drop custom INFINITERED malware, then exfiltrating by rewiring victims' own Google Workspace mail-forwarding rules. Google/Mandiant, BleepingComputer. · Jun 17 · observed · via exposed service · Threat Activity