Source linked

UNC6508 Spent 14 Months Stealing US, Canadian Research Secrets

economictimes.indiatimes.com@market_structure2 hours ago·Cybersecurity·1 comments

Google's Threat Analysis Group tracked a Chinese-linked hacking group targeting defense, AI, and medical research across a yearlong campaign.

googleunc6508cybersecuritynation state espionageresearch institutionsthreat intelligence

UNC6508 maintained a persistent presence inside US and Canadian research networks for 14 months before detection. Google's Threat Analysis Group publicly attributed the campaign to a Chinese-linked hacking group that began operations in September 2023 and only ended in November 2025.

Targets Were Defense, AI, and Medical Research

The group focused on academic, medical, and military research institutions. Exfiltrated data covered defense strategy, military technology, artificial intelligence, and medical research. That's a textbook nation-state espionage portfolio: grab the unclassified but cutting-edge work that fuels defense and economic advantage.

UNC6508's operational tempo suggests a dedicated team with clear tasking. Running a campaign for over a year without being publicized until now implies they either evaded detection or the victims didn't notice the bleeding. Google notified the affected organizations after its analysis confirmed the activity.

Attribution without Public Finger-Pointing

Google stopped short of naming a specific Chinese state sponsor, but the UNC6508 designation ties the group to Chinese interests. The technical indicators and targeting patterns align with known advanced persistent threat (APT) groups operating from China. Expect the US and Canadian cybersecurity agencies to issue joint advisories soon.

Next: research institutions need to treat their network perimeters as porous against determined adversaries. If a group can operate for over a year without triggering alarms, the shared threat intelligence model between academia and government needs a faster feedback loop.

Source: Chinese-linked hackers targeted US, Canadian research facilities for a year: Google
Domain: economictimes.indiatimes.com

Read original source ->

External source stays available while the OJO article and comment thread stay local.

More in Cybersecurity

view topic
AI-Driven Vulnerability Discovery Shrinks Exploit Gap From Years to Hours, Docker Joins Cross-Industry Defense

Docker is joining the Athena coalition as AI models like Anthropic's Mythos find novel chained vulnerabilities at machine speed, compressing the window between discovery and weaponization to hours.

380,000 Unreviewed AI-Built Apps Expose the Limits of Shadow IT Policy

RedAccess scanning found 380,000 publicly accessible assets built on vibe coding platforms, 5,000 of them leaking corporate secrets.

Chinese Hackers Turned Office 365 Compliance Rules Against REDCap Medical Servers

UNC6508 deployed InfiniteRed malware on exposed REDCap servers for over a year, then used Office 365 content compliance rules to automatically email stolen medical research to a Gmail account.

SearchLeak Chain Turns Microsoft 365 Copilot Into Silent Data Theft Tool

Varonis researchers chained a parameter-to-prompt injection, a race condition, and a Bing SSRF to steal emails, documents, and calendar data via a single URL.

Comments load interactively on the live page.