A Chinese-linked hacking group secretly stole data from academic, medical and military research institutions in the U.S. and Canada for more than a year before being discovered, according to a report published by Google on Monday.
The campaign, which ran between September 2023 and November 2025, targeted information related to defence intelligence, Indo-Pacific military strategy, artificial intelligence, unmanned systems, cyber warfare programmes and medical research, according to researchers at Google's Threat Intelligence Group.
Google did not identify the affected organisations but said they collectively employ thousands of people and manage research budgets worth billions of dollars.
The targeted institutions worked across a wide range of fields, including drug discovery, clinical trials, public health policy and military readiness.
Google attributed the operation to a relatively new cyber-espionage group it tracks as UNC6508.
Luke McNamara, deputy chief analyst at Google's Threat Intelligence Group, said the group's tactics were broadly consistent with long-standing Chinese cyber-espionage activities focused on gathering information of interest to the Chinese government.
The Embassy of the People's Republic of China in the U.S. did not immediately respond to requests for comment. Beijing has repeatedly denied carrying out or supporting illegal hacking operations.
According to Google's report, the earliest known activity linked to the campaign dates back to September 2023, when hackers exploited vulnerabilities in servers running REDCap, a web application widely used by universities, hospitals and non-profit organisations to manage surveys and databases.
The attackers used custom-made malware to steal legitimate REDCap login credentials and gain access to targeted networks.
Once inside, they created an automated system that forwarded emails containing nearly 150 selected keywords and search terms to a Gmail account under their control.
REDCap did not immediately respond to requests for comment.
The list of keywords included phone numbers and email addresses associated with targeted organisations, as well as terms linked to geopolitical policy, military strategy, advanced technologies and medical research.
The operation's focus on sensitive strategic sectors suggests an effort to gather intelligence spanning both national security and scientific innovation.
Google said it eventually identified multiple compromised institutions across the U.S. and Canada and notified each of the affected organisations.
The findings highlight the continued threat posed by state-linked cyber-espionage campaigns targeting research institutions, particularly those working on advanced technologies and defence-related projects that are increasingly viewed as critical to national security.
Russia said its air defences downed 180 drones over the Moscow region overnight, with 620 drones reportedly targeting the area, according to Moscow...
Iran has warned it will shift to a “fully offensive” military posture if efforts to reach a permanent peace deal with the U.S. fail, se...
At least four people were killed, including the alleged shooter, and nine injured in a shooting at a high school in the southern Philippine ci...
At least 11 people were killed in Israeli strikes on southern Lebanon on Saturday, among the deadliest since a June ceasefire. Meanwhile, Qatar denied holding Iranian pilots. It said it had found the remains of one pilot after an airspace violation and had contacted Iran to coordinate a handover.
U.S. President Donald Trump says Washington is not seeking an extension of its memorandum of understanding with Iran, claiming the U.S. already controls the Strait of Hormuz through its naval blockade.
A wildfire in Croatia driven by strong winds descended on the tourist town of Omis overnight, engulfing houses, forcing about 1,000 people to evacuate to safety and injuring dozens, fire brigade and health officials said on Friday.
South Korea's presidential Blue House said on Monday it was reviewing U.S. President Donald Trump's comments on scaling back joint military drills. It added that it hoped a favourable relationship between Washington and Pyongyang could lead to meaningful talks.
Residents of villages in eastern Indonesia hit by a deadly earthquake that killed at least 54 people were awaiting aid on Monday as rescuers prepared to comb through collapsed buildings in search of people trapped beneath the rubble.
Russia said its air defences downed 180 drones over the Moscow region overnight, with 620 drones reportedly targeting the area, according to Moscow Mayor Sergei Sobyanin.
At least four people were killed, including the alleged shooter, and nine injured in a shooting at a high school in the southern Philippine city of Zamboanga, according to The Manila Times reported.
The economic losses from a powerful earthquake that struck Colombia last week are expected to reach 30 trillion pesos ($9.58 billion), Colombia's President Abelardo De La Espriella said on Monday.
Taiwan is preparing to spend more money on its military than ever before, with President Lai Ching-te announcing plans for a record defence budget of $31.4 billion for 2027, taking military spending above three per cent of GDP for the first time.
German Chancellor Friedrich Merz is facing growing pressure as his approval ratings fall and the far-right Alternative for Germany (AfD) party gains support.
You can download the AnewZ application from Play Store and the App Store.
What is your opinion on this topic?
Leave the first comment