A Chinese-linked hacking group secretly stole data from academic, medical and military research institutions in the U.S. and Canada for more than a year before being discovered, according to a report published by Google on Monday.
The campaign, which ran between September 2023 and November 2025, targeted information related to defence intelligence, Indo-Pacific military strategy, artificial intelligence, unmanned systems, cyber warfare programmes and medical research, according to researchers at Google's Threat Intelligence Group.
Google did not identify the affected organisations but said they collectively employ thousands of people and manage research budgets worth billions of dollars.
The targeted institutions worked across a wide range of fields, including drug discovery, clinical trials, public health policy and military readiness.
Google attributed the operation to a relatively new cyber-espionage group it tracks as UNC6508.
Luke McNamara, deputy chief analyst at Google's Threat Intelligence Group, said the group's tactics were broadly consistent with long-standing Chinese cyber-espionage activities focused on gathering information of interest to the Chinese government.
The Embassy of the People's Republic of China in the U.S. did not immediately respond to requests for comment. Beijing has repeatedly denied carrying out or supporting illegal hacking operations.
According to Google's report, the earliest known activity linked to the campaign dates back to September 2023, when hackers exploited vulnerabilities in servers running REDCap, a web application widely used by universities, hospitals and non-profit organisations to manage surveys and databases.
The attackers used custom-made malware to steal legitimate REDCap login credentials and gain access to targeted networks.
Once inside, they created an automated system that forwarded emails containing nearly 150 selected keywords and search terms to a Gmail account under their control.
REDCap did not immediately respond to requests for comment.
The list of keywords included phone numbers and email addresses associated with targeted organisations, as well as terms linked to geopolitical policy, military strategy, advanced technologies and medical research.
The operation's focus on sensitive strategic sectors suggests an effort to gather intelligence spanning both national security and scientific innovation.
Google said it eventually identified multiple compromised institutions across the U.S. and Canada and notified each of the affected organisations.
The findings highlight the continued threat posed by state-linked cyber-espionage campaigns targeting research institutions, particularly those working on advanced technologies and defence-related projects that are increasingly viewed as critical to national security.
Russia and Ukraine have begun a regional ceasefire to allow the start of a humanitarian effort in the Russian-occu...
Kyrgyzstan doubled its petrol and diesel production in the first nine months of 2026, as disruptions at Russian oil refineries strained fuel suppli...
Jordan said its air force killed more than 20 Islamic State militants in strikes on southern Syria on Monday night. ...
Uzbekistan summoned Iran’s ambassador following claims by several Iranian diplomatic missions that the historical and architectural heritage of Samarkand belongs to Persian or Iranian-Islamic civilisation, Tashkent's Foreign Ministry said.
Serbia's Aleksandar Vučić has conceded defeat after a student-led protest movement took the majority of seats in Sunday's parliamentary elections.
Russian strikes hit several parts of Ukraine overnight, injuring at least six people and targeting energy and port infrastructure, as President Volodymyr Zelenskyy said U.S. warnings about imminent Russian ballistic missile attacks had resumed.
Russia and Ukraine have begun a regional ceasefire to allow the start of a humanitarian effort in the Russian-occupied town of Oleshky, both sides said on Tuesday, but they continue strikes elsewhere, including the Ukrainian capital of Kyiv.
Iran's Supreme National Security Council says senior officials from Saudi Arabia, Pakistan and Türkiye will travel to Tehran to discuss regional security.
Russia and Ukraine have begun a regional ceasefire to allow the start of a humanitarian effort in the Russian-occupied town of Oleshky, both sides said on Tuesday, but they continue strikes elsewhere, including the Ukrainian capital of Kyiv.
UK prosecutors have charged two men over an incident in September at RAF Fairford, a Royal Air Force base in south-west England used by U.S. forces. British counter-terrorism police said the pair are suspected of assisting Iran.
Thousands of people along India's eastern coast have been evacuated to safety, and some train services have been cancelled, one day before a severe cyclone was scheduled to make landfall, bringing gusting winds and heavy rain.
The Pentagon is prepared to launch potentially major military operations against Iran within 96 hours of receiving an order from U.S. President Donald Trump, with sufficient forces already deployed in the Middle East, according to a CNN report.
Here's your AnewZ Daily Brief for 27 October 2026, covering a local ceasefire for humanitarian operations in the Russian-occupied town of Oleshky, fresh attacks affecting civilians, and the latest military, diplomatic and international developments surrounding the Russia-Ukraine war.
You can download the AnewZ application from Play Store and the App Store.
What is your opinion on this topic?
Leave the first comment