A Chinese-linked hacking group secretly stole data from academic, medical and military research institutions in the U.S. and Canada for more than a year before being discovered, according to a report published by Google on Monday.
The campaign, which ran between September 2023 and November 2025, targeted information related to defence intelligence, Indo-Pacific military strategy, artificial intelligence, unmanned systems, cyber warfare programmes and medical research, according to researchers at Google's Threat Intelligence Group.
Google did not identify the affected organisations but said they collectively employ thousands of people and manage research budgets worth billions of dollars.
The targeted institutions worked across a wide range of fields, including drug discovery, clinical trials, public health policy and military readiness.
Google attributed the operation to a relatively new cyber-espionage group it tracks as UNC6508.
Luke McNamara, deputy chief analyst at Google's Threat Intelligence Group, said the group's tactics were broadly consistent with long-standing Chinese cyber-espionage activities focused on gathering information of interest to the Chinese government.
The Embassy of the People's Republic of China in the U.S. did not immediately respond to requests for comment. Beijing has repeatedly denied carrying out or supporting illegal hacking operations.
According to Google's report, the earliest known activity linked to the campaign dates back to September 2023, when hackers exploited vulnerabilities in servers running REDCap, a web application widely used by universities, hospitals and non-profit organisations to manage surveys and databases.
The attackers used custom-made malware to steal legitimate REDCap login credentials and gain access to targeted networks.
Once inside, they created an automated system that forwarded emails containing nearly 150 selected keywords and search terms to a Gmail account under their control.
REDCap did not immediately respond to requests for comment.
The list of keywords included phone numbers and email addresses associated with targeted organisations, as well as terms linked to geopolitical policy, military strategy, advanced technologies and medical research.
The operation's focus on sensitive strategic sectors suggests an effort to gather intelligence spanning both national security and scientific innovation.
Google said it eventually identified multiple compromised institutions across the U.S. and Canada and notified each of the affected organisations.
The findings highlight the continued threat posed by state-linked cyber-espionage campaigns targeting research institutions, particularly those working on advanced technologies and defence-related projects that are increasingly viewed as critical to national security.
At least five people were killed and five others injured when an Amazon Prime Air cargo plane overran a runway and crashed while landing at Miami I...
Baku Climate Action Week (BCAW) 2026 has begun in Azerbaijan’s capital, bringing together government representatives, business leaders, inves...
Shipping through the Strait of Hormuz has plunged to its lowest level since May following a sharp escalation in attacks on tankers by U.S. and Iran...
An eruption of Indonesia’s Mount Anak Krakatau has disrupted air travel, school activities and fishing operations, with hundreds of passengers stranded at Jakarta’s main airport on Sunday.
Iranian Parliament Speaker Mohammad Bagher Ghalibaf said on Sunday that the United States must recognise that the “rules of the game” in its war against Iran had changed “before it is too late”, a day after Washington struck several Iranian tankers in the Gulf.
At least five people were killed and five others injured when an Amazon Prime Air cargo plane overran a runway and crashed while landing at Miami International Airport on Sunday, 6 September, local officials said.
Two Greek military pilots were killed on Saturday when an F-4 Phantom fighter jet crashed during an air show at Tanagra air base, north of Athens, officials said.
U.S. negotiators Steve Witkoff and Jared Kushner have arrived in Moscow for peace talks on the Russia-Ukraine conflict, two people familiar with the matter said. They were met by Russian Presidential Envoy Kirill Dmitriev.
Baku Climate Action Week (BCAW) 2026 has begun in Azerbaijan’s capital, bringing together government representatives, business leaders, investors, researchers and climate experts from across the world to advance practical solutions for tackling climate change.
The Strait of Hormuz is moving into a more complicated stage of the U.S.-Iran war. Tehran says it will establish a new restricted maritime zone around the waterway, while Iran and Oman are preparing to formalise a separate shipping route intended to restore at least part of commercial traffic.
The European Union is preparing to boost investment in Greenland, as Brussels moves to deepen political and economic ties with the Arctic territory amid growing strategic competition involving the U.S., Russia and China.
North Korean leader Kim Jong Un has said a newly commissioned destroyer will become part of the country's nuclear response system, capable of delivering what he described as “annihilating retaliatory strikes”.
U.S. special envoys Jared Kushner and Steve Witkoff have held talks with Ukrainian President Volodymyr Zelenskyy in Kyiv on Sunday on efforts to end Russia’s war in Ukraine.
You can download the AnewZ application from Play Store and the App Store.
What is your opinion on this topic?
Leave the first comment