Google says Chinese hackers attacked Workspace security, hit 'a diverse set of national, state, and private medical entities' including research and defense organizations

A group of 7 hackers, 6 slightly blurred in the background and one in the foreground, all wearing black with hoods pulled up over their heads. You cannot see their faces. The hacker in the foreground sits with an open laptop in front of them. The background, behind the hackers, is a Chinese flag.

• Google GTIG exposes UNC6508, a PRC‑linked group exploiting REDCap servers with custom INFINITERED malware
• Attackers stole credentials, exfiltrated sensitive data via manipulated compliance rules, and hid for over a year
• Gmail accounts tied to campaign disabled; admins urged to enforce phishing‑resistant MFA, device‑bound sessions, and advanced protections

For more than a year, Chinese state-sponsored threat actors have been lurking in servers belonging to North American academic, medical, and military research organizations, deploying bespoke malware and exfiltrating sensitive files, experts have warned.