Chinese hackers targeted US, Canadian research facilities for over a year

According to Google's Threat Intelligence Group, the hackers gained access by exploiting vulnerabilities in servers running REDCap, a widely used web application for managing online surveys and databases. They used custom-built malicious software to steal legitimate REDCap login credentials. Once inside the networks, the group set up a system to automatically forward emails containing nearly 150 keywords and search terms to a controlled Gmail account. These terms included contact information for individuals at targeted organizations and phrases related to geo-strategic policy, military strategy, advanced technology, and medical research.

Google did not name the specific organizations targeted, but stated their work spanned drug discovery, clinical trials, public health policy, and military readiness, collectively employing thousands of people with research budgets in the billions of dollars. Google eventually identified multiple compromised organizations across the U.S. and Canada and notified each of them. The Chinese Embassy in Washington did not immediately respond to a request for comment, and Beijing regularly denies carrying out or condoning illicit hacking activity.