# UNC6508 (PRC-Nexus) Trojanizes Unpatched REDCap Research Servers with INFINITERED Malware to Spy on North American Medical, Academic & Military Research

> Google Threat Intelligence Group (GTIG) and Mandiant attribute, with high confidence, a multi-year espionage campaign to PRC-nexus actor UNC6508 that compromised externally facing, legacy REDCap research servers across North American medical, academic, and military institutions and deployed the custom modular PHP malware INFINITERED (upgrade-interceptor dropper, web-portal credential harvester, and HTTP-cookie C2 backdoor). The actor escalated via reused REDCap credentials into Google Workspace admin and abused content-compliance rules to silently BCC-forward sensitive email to an attacker Gmail account. Activity ran from September 2023 through November 2025, undetected for 18+ months.

- **Published:** 2026-06-20T00:00:00Z
- **Last reviewed:** 2026-08-28T20:30:57.907Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0891
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-unc6508-redcap-medical-research-espionage-tl-2026-0891.webp?v=1ac1c235 (Threadlinqs threat intel: UNC6508 INFINITERED REDCap Backdoor: Detection & IOCs (TL-2026-0891) — High severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-0891
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** UNC6508 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

Google Threat Intelligence Group (GTIG), in collaboration with Mandiant Consulting, published on 2026-06-15 the details of a long-running PRC-nexus cyber-espionage campaign tracked as UNC6508. The actor targeted REDCap (Research Electronic Data Capture), a web-based platform widely used across North American medical and scientific research communities, by probing externally facing servers for legacy, unpatched versions running side-by-side with current installations — a downgrade-attack opportunity (MITRE T1689). After gaining access to an externally facing REDCap web server, UNC6508 deployed a web shell named help.php, performed internal reconnaissance, and harvested database and service-account credentials. Roughly three months after initial access the actor deployed INFINITERED, a custom, modular PHP malware family that trojanizes legitimate REDCap system files.

INFINITERED has three components. (1) A dropper / upgrade interceptor: it injects malicious code into REDCap upgrade packages (Upgrade.php) so the backdoor and credential harvester are re-injected after legitimate software updates, achieving update-surviving persistence. The injection is delimited by a hardcoded GUID marker (b49e334d-9c01-463e-9bc5-00a6920fb66e, base64 YjQ5ZTMzNGQtOWMwMS00NjNlLTliYzUtMDBhNjkyMGZiNjZl) and includes special handling for AWS Elastic Beanstalk cloud deployments (it pivots on the legitimate '// If running on AWS Elastic Beanstalk' marker). (2) A credential harvester injected into the authentication file: it captures plaintext usernames and passwords from POST login requests, encrypts them with a UTC timestamp using the delimiter '[::]', and covertly stores them inside the legitimate redcap_sessions database table using session IDs prefixed xc32038474a with a 60-day expiration window. (3) A backdoor injected into the custom hooks configuration file so it executes on every REDCap page load; it listens for an HTTP Cookie named REDCAP-TOKEN whose value carries a magic-flag prefix plus an encrypted payload. An empty payload returns a beacon (OS, PHP version, working directory via getcwd(), database credentials, and server software). Command tags support arbitrary system command execution (shell_exec), file upload (move_uploaded_file), retrieval and deletion of harvested credentials, arbitrary SQL execution, and arbitrary file download (command tag ej671a16i7fd8202nu6ltfg5p6x7u).

Approximately 13 months after initial compromise, UNC6508 replayed harvested, overlapping REDCap credentials to compromise a Google Workspace administrator account. The actor then created a content-compliance rule named 'Patroit' (a misspelling of 'Patriot') that silently BCC-forwarded email matching ~150 regular-expression keywords — spanning military strategy, AI/ML, uncrewed-vehicle systems, offensive cyber programs, and medical topics (including the pathogen 'Chikungunya', tied to a July 2025 Guangdong province outbreak indicating real-time, mission-specific tasking) — to the attacker-controlled account BebitaBarefoot774@gmail.com. GTIG notes this abuse of legitimate cloud content-compliance rules for covert exfiltration had never previously been observed from a PRC-nexus actor. To frustrate detection and attribution, UNC6508 routed both the malicious admin login and Gmail access through US-based obfuscation (OBF) infrastructure: compromised ASUS routers (e.g., 23.169.65.49), residential proxies, and VPS hosts. Collection priorities — national defense, Indo-Pacific military operations, AI systems, uncrewed-vehicle technology, offensive cyber programs, and medical/biodefense research — align with PRC state intelligence requirements. GTIG published a YARA rule (G_Backdoor_INFINITERED_1), a VirusTotal collection, and updated Google SecOps with all indicators; no CVE is assigned in the source.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1190 Exploit Public-Facing Application
- T1505 Server Software Component
- T1554 Compromise Host Software Binary
- T1098 Account Manipulation
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1090 Proxy
- T1564 Hide Artifacts
- T1056 Input Capture
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1550 Use Alternate Authentication Material
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1078.004 Valid Accounts
- T1689 Downgrade Attack
- T1070 Indicator Removal
- T1059 Command and Scripting Interpreter
- T1105 Ingress Tool Transfer
- T1005 Data from Local System
- T1584.008 Compromise Infrastructure
- T1505.003 Server Software Component
- T1090.003 Proxy
- T1562.001 Impair Defenses
- T1056.003 Input Capture
- T1071.001 Application Layer Protocol
- T1114.003 Email Collection

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**INFINITERED GUID-Delimited Re-Injection of REDCap PHP Files — Post-Exploitation Persistence** (`TL-2026-0891-SPL-002`)

Detects INFINITERED update-surviving persistence: the dropper re-injects the credential harvester and backdoor into legitimate REDCap files (Upgrade.php, custom hooks, auth file), delimited by the hardcoded GUID marker b49e334d-9c01-463e-9bc5-00a6920fb66e (base64 YjQ5...). File-integrity / FIM telemetry indexing file content or hashes surfaces the GUID marker or post-upgrade drift of these specific files.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1554, T1027, T1685
- **Data sources:** file_integrity, sysmon, edr_file_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=fim sourcetype="file_integrity" (object_path="*Upgrade.php" OR object_path="*redcap_custom_hooks.php" OR object_path="*Authentication.php")
| search file_content="*b49e334d-9c01-463e-9bc5-00a6920fb66e*" OR file_content="*YjQ5ZTMzNGQtOWMwMS00NjNlLTliYzUtMDBhNjkyMGZiNjZl*" OR change_type="modified"
| eval guid_marker=if(match(file_content,"b49e334d-9c01-463e-9bc5-00a6920fb66e"),"GUID_MATCH","DRIFT_ONLY")
| stats count, values(guid_marker) as marker, values(change_type) as changes by host, object_path
| `comment("INFINITERED re-injects after legitimate upgrades; correlate file modification with recent upgrade activity to catch update-time re-injection.")`
| table _time host object_path marker changes count
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(30d)
| where FileName in ("Upgrade.php", "redcap_custom_hooks.php", "Authentication.php")
| where ActionType in ("FileModified", "FileCreated")
| join kind=leftouter (
    DeviceEvents
    | where Timestamp > ago(30d)
    | where AdditionalFields has "b49e334d-9c01-463e-9bc5-00a6920fb66e"
    | project DeviceName, MarkerTime = Timestamp
) on DeviceName
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountName, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: INFINITERED GUID Injection Marker in REDCap PHP Files
id: a72b4e91-0c33-4f57-9a18-0891b2c3d4e5
status: experimental
description: Detects the hardcoded INFINITERED GUID delimiter (or its base64 form) inside trojanized REDCap PHP files, indicating update-surviving re-injection.
references:
    - https://security.googlecloudcommunity.com/google-security-operations-2/custom-malware-named-infinitered-yara-l-rules-to-detect-unc6508-7744
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/20
tags:
    - attack.persistence
    - attack.t1554
    - attack.defense_evasion
    - attack.t1027
    - attack.t1685
logsource:
    product: linux
    category: file_event
detection:
    selection_file:
        TargetFilename|endswith:
            - 'Upgrade.php'
            - 'redcap_custom_hooks.php'
            - 'Authentication.php'
    selection_marker:
        FileContent|contains:
            - 'b49e334d-9c01-463e-9bc5-00a6920fb66e'
            - 'YjQ5ZTMzNGQtOWMwMS00NjNlLTliYzUtMDBhNjkyMGZiNjZl'
    condition: selection_file and selection_marker
falsepositives:
    - Security tooling or this simulation harness intentionally writing the benign GUID marker for detection validation
level: critical
```

**Known false positives:**

- Detection-validation labs that deliberately write the GUID marker into mock files
- Backup/restore operations that re-touch REDCap PHP files

**Tuning notes:** Enable FIM content indexing (or scheduled grep) on the REDCap application directory. Treat any GUID_MATCH as critical regardless of drift; for DRIFT_ONLY of Upgrade.php within 24h of an upgrade, escalate as possible re-injection. Run GTIG YARA G_Backdoor_INFINITERED_1 on flagged hosts.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- INFINITERED Web Shell & Public-Facing REDCap Exploitation — Exploitation (locked: unlock with TL Creds)
- INFINITERED Credential Harvester & [indicator] Session Hiding — Post-Exploitation (locked: unlock with TL Creds)
- Workspace Admin Login & Patroit BCC-Forward Rule from Obfuscation Infra — Lateral Movement / C2 (locked: unlock with TL Creds)
- INFINITERED Downgrade-Attack Probing of Legacy REDCap Versions — Exploitation (locked: unlock with TL Creds)
- INFINITERED AWS Elastic Beanstalk Pivot Marker & Auth-File Trojanization — Post-Exploitation (locked: unlock with TL Creds)
- INFINITERED Cookie-C2 Beacon Exfiltration & Encrypted Channel — C2 / Exfiltration (locked: unlock with TL Creds)
- INFINITERED Web Shell [indicator] Drop on REDCap Web Root — Exploitation (locked: unlock with TL Creds)
- INFINITERED [indicator] Cookie C2 & File-Download Command Tag — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `23.169.65[.]49`
- File hash: `ba6b73b0ca0dc7f86b3b397893ac32d729fd53f9df20643288f141f29d020af7`
- Email address: `BebitaBarefoot774[@]gmail[.]com`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing AI, Cyber, Medical, and National Defense Research](https://cloud.google.com/blog/topics/threat-intelligence/prc-targets-us-medical-research)
- [Custom Malware Named INFINITERED - YARA-L Rules to Detect UNC6508](https://security.googlecloudcommunity.com/google-security-operations-2/custom-malware-named-infinitered-yara-l-rules-to-detect-unc6508-7744)
- [PRC-Nexus Hackers Exploit REDCap Servers to Spy on US Medical Research Institutions](https://cybersecuritynews.com/prc-nexus-hackers-exploit-redcap-servers/)
- [China-Nexus Actor Spies on US Researchers Undetected for a Year](https://www.darkreading.com/threat-intelligence/china-nexus-actor-us-researchers-undetected)
- [Google says PRC-linked spies hid in medical research networks for more than a year](https://www.theregister.com/research/2026/06/15/google-says-prc-linked-spies-hid-in-medical-research-networks-for-more-than-a-year/5254547)
- [Chinese hackers breached North American research institutions via REDCap servers](https://www.helpnetsecurity.com/2026/06/15/chinese-hackers-redcap-medical-research-institutions-breach/)
- [China-linked hackers target US, Canada research using legacy REDCap exploits](https://www.csoonline.com/article/4185582/china-linked-hackers-target-us-canada-research-using-legacy-redcap-exploits.html)
- [Google says Chinese hackers cracked Workspace security to hit medical and defense organizations](https://www.techradar.com/pro/security/google-says-chinese-hackers-cracked-workspace-security-to-hit-a-diverse-set-of-national-state-and-private-medical-entities-including-research-and-defense-organizations)
- [PRC-Nexus Hackers Abuse REDCap Servers to Monitor US Medical Research Organizations](https://gbhackers.com/prc-nexus-hackers-abuse-redcap-servers/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0891