A Chinese-linked hacking group secretly stole data from academic, medical and military research institutions in the U.S. and Canada for more than a year before being discovered, according to a report published by Google on Monday.
The campaign, which ran between September 2023 and November 2025, targeted information related to defence intelligence, Indo-Pacific military strategy, artificial intelligence, unmanned systems, cyber warfare programmes and medical research, according to researchers at Google's Threat Intelligence Group.
Google did not identify the affected organisations but said they collectively employ thousands of people and manage research budgets worth billions of dollars.
The targeted institutions worked across a wide range of fields, including drug discovery, clinical trials, public health policy and military readiness.
Google attributed the operation to a relatively new cyber-espionage group it tracks as UNC6508.
Luke McNamara, deputy chief analyst at Google's Threat Intelligence Group, said the group's tactics were broadly consistent with long-standing Chinese cyber-espionage activities focused on gathering information of interest to the Chinese government.
The Embassy of the People's Republic of China in the U.S. did not immediately respond to requests for comment. Beijing has repeatedly denied carrying out or supporting illegal hacking operations.
According to Google's report, the earliest known activity linked to the campaign dates back to September 2023, when hackers exploited vulnerabilities in servers running REDCap, a web application widely used by universities, hospitals and non-profit organisations to manage surveys and databases.
The attackers used custom-made malware to steal legitimate REDCap login credentials and gain access to targeted networks.
Once inside, they created an automated system that forwarded emails containing nearly 150 selected keywords and search terms to a Gmail account under their control.
REDCap did not immediately respond to requests for comment.
The list of keywords included phone numbers and email addresses associated with targeted organisations, as well as terms linked to geopolitical policy, military strategy, advanced technologies and medical research.
The operation's focus on sensitive strategic sectors suggests an effort to gather intelligence spanning both national security and scientific innovation.
Google said it eventually identified multiple compromised institutions across the U.S. and Canada and notified each of the affected organisations.
The findings highlight the continued threat posed by state-linked cyber-espionage campaigns targeting research institutions, particularly those working on advanced technologies and defence-related projects that are increasingly viewed as critical to national security.
A large Ukrainian drone attack on Moscow and the surrounding region has killed two people, damaged homes and sparked a major fire at a key fuel fac...
Kenya has confirmed its first case of Ebola after a Kenyan citizen who had travelled from the Democratic Republic of Congo (DRC) died in Nairobi, p...
Most people meet artificial intelligence (AI) through a phone. It suggests the next word, sorts the photos, fla...
Australian counterterrorism authorities are examining the links of the co-pilot accused of attacking the captain and attempting to take control of a flydubai flight bound for Israel. Authorities in New Zealand have also said they are investigating reports the suspect had spent time in that country.
Right-wing Brazilian Senator Flavio Bolsonaro will face leftist President Luiz Inacio Lula da Silva in a runoff of the presidential election later this month, after he exceeded expectations in Sunday's first-round vote with a slight lead over the incumbent.
U.S. President Donald Trump has said that the United States will 'help' Russia after a laboratory worker died at a plague research institute in Siberia.
Iran's Oil Minister Mohsen Paknejad has resigned, with Hamid Bovard, chief executive of the state-owned National Iranian Oil Company (NIOC), appointed as acting oil minister, according to Iranian state media.
Candidates elected to Bosnia and Herzegovina's three-member presidency declared victory after preliminary unofficial results showed Denis Becirovic leading the Bosniak seat, Darijana Filipovic ahead in the Croat seat and Zeljka Cvijanovic likely retaining the Serb seat.
A large Ukrainian drone attack on Moscow and the surrounding region has killed two people, damaged homes and sparked a major fire at a key fuel facility, according to Russian officials and military bloggers.
Kenya has confirmed its first case of Ebola after a Kenyan citizen who had travelled from the Democratic Republic of Congo (DRC) died in Nairobi, prompting health authorities to launch an urgent contact-tracing operation.
A regional conference on Afghanistan in Moscow ended on Monday without a joint statement after Pakistan and the Afghan Taliban delegation failed to agree on wording about terrorism. It was the first time since the inaugural meeting that participants failed to issue a joint statement.
An Azerbaijani citizen died and another is missing after a cargo ship was attacked by a drone in the Black Sea, near the coast of Romania on Monday (5 October), Baku's Foreign Ministry has said.
South Korea is preparing a response to press North Korea into apologising for a landmine explosion in the Demilitarized Zone (DMZ) that seriously wounded two of its soldiers, a Defence Ministry Spokesperson has said.
You can download the AnewZ application from Play Store and the App Store.
What is your opinion on this topic?
Leave the first comment