A Chinese-linked hacking group spent over a year secretly stealing data from US and Canadian academic, medical and military research institutions before being detected, Google reported on Monday.
Between September 2023 and November 2025 hackers targeted sensitive information on defence intelligence, Indo-Pacific military strategy, artificial intelligence, unmanned vehicles, cyber warfare programmes and medical research, according to Google’s Threat Intelligence Group.
While Google did not name the compromised organisations, it noted they span fields from drug discovery and clinical trials to public health policy and military readiness. Together, these institutions employ thousands of people and manage billion-dollar research budgets.
The cyberespionage campaign was attributed to UNC6508, a relatively new hacking group. Luke McNamara, a deputy chief analyst at Google, stated that the group's methods align with long-standing Chinese-linked hacking operations aimed at gathering intelligence for Beijing.
The Chinese Embassy in Washington did not immediately respond to a request for comment. Beijing routinely denies involvement in state-sponsored hacking.
The earliest known activity dates back to September 2023, when hackers exploited vulnerabilities in REDCap, a popular web application used by nonprofits to manage online databases and surveys. Using custom malicious software, the attackers stole legitimate REDCap login credentials to breach the targeted networks.
Researchers found the hackers set up an automated system to forward emails containing nearly 150 specific keywords to a Gmail account they controlled. These search terms included the contact details of personnel at the targeted organisations, as well as topics related to advanced technology, medical research and geo-strategic policy.
Google has since identified the compromised organisations across the US and Canada and notified each of them. REDCap did not respond to requests for comment.
