threat-intel
Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails
High
Summary
A China-linked espionage group, UNC6508, gained access to North American medical, academic, and military research networks via a backdoor on REDCap servers, stealing sensitive research and defense emails. The attackers exploited Google Workspace's content compliance rules to copy targeted messages to a controlled Gmail inbox, bypassing traditional malware detection. Google disrupted the group's infrastructure and advised organizations to patch REDCap servers and review their email rule configurations.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data