Chinese hackers targeted US, Canadian research facilities for over a year

A Chinese-linked hacking group, identified by Google as UNC6508, spent more than a year secretly stealing data from U.S. and Canadian academic, medical, and military research institutions. The campaign, which ran from September 2023 to November 2025, focused on gathering information likely of interest to the Chinese government, including defense intelligence, military strategy in the Indo-Pacific, artificial intelligence, unmanned vehicles, cyber warfare programs, and medical research.

According to Google's Threat Intelligence Group, the hackers gained access by exploiting vulnerabilities in servers running REDCap, a widely used web application for managing online surveys and databases. They used custom-built malicious software to steal legitimate REDCap login credentials. Once inside the networks, the group set up a system to automatically forward emails containing nearly 150 keywords and search terms to a controlled Gmail account. These terms included contact information for individuals at targeted organizations and phrases related to geo-strategic policy, military strategy, advanced technology, and medical research.

Google did not name the specific organizations targeted, but stated their work spanned drug discovery, clinical trials, public health policy, and military readiness, collectively employing thousands of people with research budgets in the billions of dollars. Google eventually identified multiple compromised organizations across the U.S. and Canada and notified each of them. The Chinese Embassy in Washington did not immediately respond to a request for comment, and Beijing regularly denies carrying out or condoning illicit hacking activity.