UNC6508 (PRC-Nexus) Trojanizes Unpatched REDCap Research Servers with INFINITERED Malware to Spy on North American Medical, Academic & Military Research

Key facts for UNC6508 REDCap medical research espionage

Detection coverage for UNC6508 REDCap medical research espionage

As of 2026-08-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0891 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: INFINITERED GUID-Delimited Re-Injection of REDCap PHP Files — Post-Exploitation Persistence

Detects INFINITERED update-surviving persistence: the dropper re-injects the credential harvester and backdoor into legitimate REDCap files (Upgrade.php, custom hooks, auth file), delimited by the hardcoded GUID marker b49e334d-9c01-463e-9bc5-00a6920fb66e (base64 YjQ5...). File-integrity / FIM telemetry indexing file content or hashes surfaces the GUID marker or post-upgrade drift of these specific files.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1554, T1027, T1685
• Data sources: file_integrity, sysmon, edr_file_events
• Severity: critical
• Confidence: high

Splunk SPL

index=fim sourcetype="file_integrity" (object_path="*Upgrade.php" OR object_path="*redcap_custom_hooks.php" OR object_path="*Authentication.php")
| search file_content="*b49e334d-9c01-463e-9bc5-00a6920fb66e*" OR file_content="*YjQ5ZTMzNGQtOWMwMS00NjNlLTliYzUtMDBhNjkyMGZiNjZl*" OR change_type="modified"
| eval guid_marker=if(match(file_content,"b49e334d-9c01-463e-9bc5-00a6920fb66e"),"GUID_MATCH","DRIFT_ONLY")
| stats count, values(guid_marker) as marker, values(change_type) as changes by host, object_path
| `comment("INFINITERED re-injects after legitimate upgrades; correlate file modification with recent upgrade activity to catch update-time re-injection.")`
| table _time host object_path marker changes count

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(30d)
| where FileName in ("Upgrade.php", "redcap_custom_hooks.php", "Authentication.php")
| where ActionType in ("FileModified", "FileCreated")
| join kind=leftouter (
    DeviceEvents
    | where Timestamp > ago(30d)
    | where AdditionalFields has "b49e334d-9c01-463e-9bc5-00a6920fb66e"
    | project DeviceName, MarkerTime = Timestamp
) on DeviceName
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountName, SHA256
| order by Timestamp desc

Sigma

title: INFINITERED GUID Injection Marker in REDCap PHP Files
id: a72b4e91-0c33-4f57-9a18-0891b2c3d4e5
status: experimental
description: Detects the hardcoded INFINITERED GUID delimiter (or its base64 form) inside trojanized REDCap PHP files, indicating update-surviving re-injection.
references:
    - https://security.googlecloudcommunity.com/google-security-operations-2/custom-malware-named-infinitered-yara-l-rules-to-detect-unc6508-7744
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/20
tags:
    - attack.persistence
    - attack.t1554
    - attack.defense_evasion
    - attack.t1027
    - attack.t1685
logsource:
    product: linux
    category: file_event
detection:
    selection_file:
        TargetFilename|endswith:
            - 'Upgrade.php'
            - 'redcap_custom_hooks.php'
            - 'Authentication.php'
    selection_marker:
        FileContent|contains:
            - 'b49e334d-9c01-463e-9bc5-00a6920fb66e'
            - 'YjQ5ZTMzNGQtOWMwMS00NjNlLTliYzUtMDBhNjkyMGZiNjZl'
    condition: selection_file and selection_marker
falsepositives:
    - Security tooling or this simulation harness intentionally writing the benign GUID marker for detection validation
level: critical

Known false positives:

• Detection-validation labs that deliberately write the GUID marker into mock files
• Backup/restore operations that re-touch REDCap PHP files

Tuning notes: Enable FIM content indexing (or scheduled grep) on the REDCap application directory. Treat any GUID_MATCH as critical regardless of drift; for DRIFT_ONLY of Upgrade.php within 24h of an upgrade, escalate as possible re-injection. Run GTIG YARA G_Backdoor_INFINITERED_1 on flagged hosts.

• 🔒 INFINITERED Web Shell & Public-Facing REDCap Exploitation — Exploitation · unlock with TL Creds
• 🔒 INFINITERED Credential Harvester & [indicator] Session Hiding — Post-Exploitation · unlock with TL Creds
• 🔒 Workspace Admin Login & Patroit BCC-Forward Rule from Obfuscation Infra — Lateral Movement / C2 · unlock with TL Creds
• 🔒 INFINITERED Downgrade-Attack Probing of Legacy REDCap Versions — Exploitation · unlock with TL Creds
• 🔒 INFINITERED AWS Elastic Beanstalk Pivot Marker & Auth-File Trojanization — Post-Exploitation · unlock with TL Creds
• 🔒 INFINITERED Cookie-C2 Beacon Exfiltration & Encrypted Channel — C2 / Exfiltration · unlock with TL Creds
• 🔒 INFINITERED Web Shell [indicator] Drop on REDCap Web Root — Exploitation · unlock with TL Creds
• 🔒 INFINITERED [indicator] Cookie C2 & File-Download Command Tag — C2 · unlock with TL Creds

Indicators of compromise for UNC6508 REDCap medical research espionage

As of 2026-08-28, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-0891.

Sample indicators (3 of 20)

• IP address: 23.169.65[.]49
• File hash: ba6b73b0ca0dc7f86b3b397893ac32d729fd53f9df20643288f141f29d020af7
• Email address: BebitaBarefoot774[@]gmail[.]com

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

How UNC6508 REDCap medical research espionage works

The actor escalated via reused REDCap credentials into Google Workspace admin and abused content-compliance rules to silently BCC-forward sensitive email to an attacker Gmail account. Activity ran from September 2023 through November 2025, undetected for 18+ months.

Google Threat Intelligence Group (GTIG), in collaboration with Mandiant Consulting, published on 2026-06-15 the details of a long-running PRC-nexus cyber-espionage campaign tracked as UNC6508. The actor targeted REDCap (Research Electronic Data Capture), a web-based platform widely used across North American medical and scientific research communities, by probing externally facing servers for legacy, unpatched versions running side-by-side with current installations — a downgrade-attack opportunity (MITRE T1689). After gaining access to an externally facing REDCap web server, UNC6508 deployed a web shell named help.php, performed internal reconnaissance, and harvested database and service-account credentials. Roughly three months after initial access the actor deployed INFINITERED, a custom, modular PHP malware family that trojanizes legitimate REDCap system files.

INFINITERED has three components. (1) A dropper / upgrade interceptor: it injects malicious code into REDCap upgrade packages (Upgrade.php) so the backdoor and credential harvester are re-injected after legitimate software updates, achieving update-surviving persistence. The injection is delimited by a hardcoded GUID marker (b49e334d-9c01-463e-9bc5-00a6920fb66e, base64 YjQ5ZTMzNGQtOWMwMS00NjNlLTliYzUtMDBhNjkyMGZiNjZl) and includes special handling for AWS Elastic Beanstalk cloud deployments (it pivots on the legitimate '// If running on AWS Elastic Beanstalk' marker). (2) A credential harvester injected into the authentication file: it captures plaintext usernames and passwords from POST login requests, encrypts them with a UTC timestamp using the delimiter '[::]', and covertly stores them inside the legitimate redcap_sessions database table using session IDs prefixed xc32038474a with a 60-day expiration window. (3) A backdoor injected into the custom hooks configuration file so it executes on every REDCap page load; it listens for an HTTP Cookie named REDCAP-TOKEN whose value carries a magic-flag prefix plus an encrypted payload. An empty payload returns a beacon (OS, PHP version, working directory via getcwd(), database credentials, and server software). Command tags support arbitrary system command execution (shell_exec), file upload (move_uploaded_file), retrieval and deletion of harvested credentials, arbitrary SQL execution, and arbitrary file download (command tag ej671a16i7fd8202nu6ltfg5p6x7u).

Approximately 13 months after initial compromise, UNC6508 replayed harvested, overlapping REDCap credentials to compromise a Google Workspace administrator account. The actor then created a content-compliance rule named 'Patroit' (a misspelling of 'Patriot') that silently BCC-forwarded email matching ~150 regular-expression keywords — spanning military strategy, AI/ML, uncrewed-vehicle systems, offensive cyber programs, and medical topics (including the pathogen 'Chikungunya', tied to a July 2025 Guangdong province outbreak indicating real-time, mission-specific tasking) — to the attacker-controlled account BebitaBarefoot774@gmail.com. GTIG notes this abuse of legitimate cloud content-compliance rules for covert exfiltration had never previously been observed from a PRC-nexus actor. To frustrate detection and attribution, UNC6508 routed both the malicious admin login and Gmail access through US-based obfuscation (OBF) infrastructure: compromised ASUS routers (e.g., 23.169.65.49), residential proxies, and VPS hosts. Collection priorities — national defense, Indo-Pacific military operations, AI systems, uncrewed-vehicle technology, offensive cyber programs, and medical/biodefense research — align with PRC state intelligence requirements. GTIG published a YARA rule (G_Backdoor_INFINITERED_1), a VirusTotal collection, and updated Google SecOps with all indicators; no CVE is assigned in the source.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1114 Email Collection; T1114.003 Email Collection; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1090.003 Proxy; T1562.001 Impair Defenses; T1564 Hide Artifacts; T1689 Downgrade Attack

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Credential Access

T1056 Input Capture; T1056.003 Input Capture; T1552 Unsecured Credentials

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1071.001 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Privilege Escalation

T1078.004 Valid Accounts

command-and-control

T1090 Proxy

Persistence

T1098 Account Manipulation; T1505 Server Software Component; T1505.003 Server Software Component; T1554 Compromise Host Software Binary

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1550 Use Alternate Authentication Material

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1584.008 Compromise Infrastructure

Reconnaissance

T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Remediation for UNC6508 REDCap medical research espionage

Patches

• Patch REDCap to the latest version and fully remove all legacy/older REDCap installations to eliminate downgrade paths

Immediate actions

• Scan all REDCap servers with GTIG's published YARA rule G_Backdoor_INFINITERED_1 for INFINITERED components
• Inspect Upgrade.php, custom hooks configuration, and authentication files for the GUID injection marker b49e334d-9c01-463e-9bc5-00a6920fb66e (and its base64 form)
• Search web roots for the web shell help.php and remove it
• Audit Google Workspace content-compliance/forwarding rules for unauthorized BCC rules (e.g., 'Patroit') and remove them; disable BCC-forwarding to external addresses
• Hunt web/proxy logs for the HTTP Cookie REDCAP-TOKEN and for the command tag ej671a16i7fd8202nu6ltfg5p6x7u
• Query the redcap_sessions table for session IDs prefixed xc32038474a and purge malicious records
• Block/monitor the IOC IP 23.169.65.49 and the exfil account BebitaBarefoot774@gmail.com

Workarounds

• Disable side-by-side operation of multiple REDCap versions
• Restrict external exposure of REDCap admin interfaces and place behind access controls

Longer-term hardening

• Enforce phishing-resistant 2-Step Verification on all admin and IdP accounts; enroll sensitive accounts in Advanced Protection Program
• Use unique credentials across security domains to prevent credential replay between REDCap and Workspace
• Deploy Device Bound Session Credentials (DBSC) with Context-Aware Access to defeat cookie/session theft
• Enable Data Loss Prevention (DLP) and route Workspace audit logs into SIEM; alert on content-compliance and forwarding-rule changes
• Establish file-integrity monitoring on REDCap application files to detect upgrade-time re-injection

Affected and fixed versions

• Vanderbilt University — REDCap (Research Electronic Data Capture)
  Vulnerable versions: legacy/unpatched versions run side-by-side with current installations
  Fixed in: latest REDCap release with all legacy versions removed
• Google — Google Workspace (content compliance / Gmail routing rules)
  Vulnerable versions: admin-configurable content-compliance rules abused via compromised admin account

Timeline of UNC6508 REDCap medical research espionage

Last updated 2026-08-28 · revalidated 1× · latest source

• 2023-09-01 Earliest known compromise: UNC6508 exploits an externally facing, legacy/unpatched REDCap research server and deploys the locked-ioc-19 web shell.
• 2023-10-01 Internal reconnaissance and discovery; harvesting of database and service-account credentials from the compromised REDCap environment.
• 2023-12-01 Approximately three months after initial access, UNC6508 deploys the modular locked-ioc-18 malware (upgrade-interceptor dropper, credential harvester, and HTTP-cookie backdoor) by trojanizing legitimate REDCap files.
• 2024-11-01 Roughly 13 months after compromise, harvested overlapping REDCap credentials are replayed to compromise a Google Workspace administrator account via US-based obfuscation infrastructure.
• 2024-11-15 Actor creates the 'Patroit' Google Workspace content-compliance rule that silently BCC-forwards email matching ~150 keywords to locked-ioc-11.
• 2025-07-01 Keyword set includes 'Chikungunya', aligning with a July 2025 Guangdong province outbreak and indicating real-time, mission-specific intelligence tasking.
• 2025-11-01 Latest observed UNC6508 activity; campaign had persisted undetected for 18+ months across US and Canadian institutions.
• 2026-06-15 Google Threat Intelligence Group and Mandiant publicly disclose the campaign, releasing IOCs, a YARA rule (locked-ioc-12), and a VirusTotal collection, and notifying affected organizations.

Update history

• 2026-08-28 — UNC6508 (PRC-Nexus) Targets US Medical, Defense, and AI Research via REDCap Exploitation and locked-ioc-18 Backdoor: What changed No evidence-backed change to severity_level, exploitability, status, or attribution_confidence — same UNC6508 REDCap/locked-ioc-18 campaign, same core facts. The newer report contributes MITRE ATT&CK precision (6 techniques not

Sources cited for UNC6508 REDCap medical research espionage

• Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing AI, Cyber, Medical, and National Defense Research Google Cloud · Vendor report · 2026-06-15
• Custom Malware Named INFINITERED - YARA-L Rules to Detect UNC6508 security.googlecloudcommunity.com · Vendor report · 2026-06-15
• PRC-Nexus Hackers Exploit REDCap Servers to Spy on US Medical Research Institutions cybersecuritynews.com · News · 2026-06-16
• China-Nexus Actor Spies on US Researchers Undetected for a Year Dark Reading · News · 2026-06-15
• Google says PRC-linked spies hid in medical research networks for more than a year The Register · News · 2026-06-15
• Chinese hackers breached North American research institutions via REDCap servers Help Net Security · News · 2026-06-15
• China-linked hackers target US, Canada research using legacy REDCap exploits csoonline.com · News · 2026-06-15
• Google says Chinese hackers cracked Workspace security to hit medical and defense organizations techradar.com · News · 2026-06-15
• PRC-Nexus Hackers Abuse REDCap Servers to Monitor US Medical Research Organizations gbhackers.com · News · 2026-06-16

Threats related to UNC6508 REDCap medical research espionage

• Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiled

More from UNC6508

• ASEC June 2026 APT Trend Report: Nation-State Actors Pivot to Cloud/OAuth Abuse, MaaS, and Supply-Chain Compromise

Previous and next in apt

• OceanLotus (APT32) — Vietnamese State-Aligned Cyber Espionage Group: Tactics, Malware, and TTPs Previous report
• Nation-State Pre-Positioning Intrusion into Australian Critical Infrastructure (ASIO 2026 Threat Assessment Disclosure) Next report