A Chinese-linked hacking group secretly stole data from academic, medical and military research institutions in the U.S. and Canada for more than a year before being discovered, according to a report published by Google on Monday.
The campaign, which ran between September 2023 and November 2025, targeted information related to defence intelligence, Indo-Pacific military strategy, artificial intelligence, unmanned systems, cyber warfare programmes and medical research, according to researchers at Google's Threat Intelligence Group.
Google did not identify the affected organisations but said they collectively employ thousands of people and manage research budgets worth billions of dollars.
The targeted institutions worked across a wide range of fields, including drug discovery, clinical trials, public health policy and military readiness.
Google attributed the operation to a relatively new cyber-espionage group it tracks as UNC6508.
Luke McNamara, deputy chief analyst at Google's Threat Intelligence Group, said the group's tactics were broadly consistent with long-standing Chinese cyber-espionage activities focused on gathering information of interest to the Chinese government.
The Embassy of the People's Republic of China in the U.S. did not immediately respond to requests for comment. Beijing has repeatedly denied carrying out or supporting illegal hacking operations.
According to Google's report, the earliest known activity linked to the campaign dates back to September 2023, when hackers exploited vulnerabilities in servers running REDCap, a web application widely used by universities, hospitals and non-profit organisations to manage surveys and databases.
The attackers used custom-made malware to steal legitimate REDCap login credentials and gain access to targeted networks.
Once inside, they created an automated system that forwarded emails containing nearly 150 selected keywords and search terms to a Gmail account under their control.
REDCap did not immediately respond to requests for comment.
The list of keywords included phone numbers and email addresses associated with targeted organisations, as well as terms linked to geopolitical policy, military strategy, advanced technologies and medical research.
The operation's focus on sensitive strategic sectors suggests an effort to gather intelligence spanning both national security and scientific innovation.
Google said it eventually identified multiple compromised institutions across the U.S. and Canada and notified each of the affected organisations.
The findings highlight the continued threat posed by state-linked cyber-espionage campaigns targeting research institutions, particularly those working on advanced technologies and defence-related projects that are increasingly viewed as critical to national security.
Saudi Arabia said its overnight strikes on Iran-backed group targets in Iraq were carried out in self-defence and warned it would take further militar...
A fire involving two gas vessels at Egypt's Damietta port has prompted conflicting reports over whether the incident was caused by a drone strike or a...
Pakistan has declared hepatitis C a national emergency and launched a nationwide campaign to screen more than 164 million people, as it steps up effor...
French DJ and electropop musician Kavinsky, whose atmospheric sound shaped a generation of electronic music fans, has died at the age of 50, French authorities said on Tuesday.
U.S. President Donald Trump said on Monday that there is a good chance” of reaching a deal with Iran, but warned that Washington would resume military operation if negotiations fail.
Yemen warned the Houthis were seeking to replicate Iran's Strait of Hormuz strategy in the Red Sea, as U.S. President Donald Trump said there was a "good chance" of a deal with Tehran but warned strikes could resume if talks failed.
Saudi Arabia said its overnight strikes on Iran-backed group targets in Iraq were carried out in self-defence and warned it would take further military action if the groups launched new attacks against the kingdom.
Moscow should stop linking Russia-Armenia relations to Azerbaijan, Baku's Foreign Ministry spokesperson Aykhan Hajizada has said, after Russia again raised the Collective Security Treaty Organisation's role during the former Garabagh conflict.
The Islamic Revolutionary Guard Corps (IRGC) said it targeted three tankers and stopped them in Iran's southern waters early on Wednesday. It also announced a ballistic missile attack on two U.S. bases in Jordan.
On 29 July, AnewZ's Daybreak focused on meetings involving Donald Trump, Volodymyr Zelenskyy and Benjamin Netanyahu, escalating tensions in the Middle East following U.S. military action, and the funeral of U.S. Senator Lindsey Graham.
The European Union has added Russian energy company Inter RAO to its latest sanctions package, raising questions over the future of Georgia's power sector. The move could have implications for electricity supplies in Tbilisi because of the company's indirect ownership of key energy assets.
Russia’s largest retailer Wildberries has begun searching for warehouse space in Kazakhstan, Moscow’s Kommersant newspaper has reported, citing sources in the real estate market. It comes after Ukrainian drone strikes damaged around 10 per cent of the online marketplace's logistics hubs in Russia.
Yerevan has seen a surge in Russians seeking apartments ahead of Moscow's parliamentary elections in September and amid rumours of mass mobilisation, Russian-language publication Verstka has reported, citing anecdotal evidence from local estate agents.
You can download the AnewZ application from Play Store and the App Store.
What is your opinion on this topic?
Leave the first comment