Google Finds China-Linked Hackers Used Workspace Rules to BCC Emails After Breaching REDCap Servers at Research Institutions
Google said a China-linked hacking campaign breached externally accessible REDCap servers at North American academic, medical and military research institutions, then abused Google Workspace rules to secretly BCC emails matching nearly 150 keywords. Several organizations in the US and Canada were compromised, Google said.
The attackers installed custom malware called InfiniteRed to steal legitimate REDCap login credentials, and the first known breach dates to September 2023, according to Google. The company said it shut down the malicious network and added intelligence to help defenders spot indicators of compromise on their networks.
From the sources (11 posts)
@firstsquawkGOOGLE IDENTIFIES A CAMPAIGN LINKED TO UNC6508, A THREAT ACTOR FROM CHINA.
@firstsquawkGOOGLE HAS SPOTTED A CAMPAIGN AIMING AT NORTH AMERICAN ACADEMIC, MEDICAL, AND MILITARY RESEARCH INSTITUTIONS.
@firstsquawkGOOGLE'S THREAT INTELLIGENCE TEAM SHUTDOWN MALICIOUS NETWORK LINKED TO A THREAT ACTOR.
@firstsquawkGOOGLE IMPROVES SECURITY OPERATIONS BY ADDING USEFUL INTELLIGENCE, HELPING DEFENDERS SPOT COMPROMISE INDICATORS IN NETWORKS.
@firstsquawkGOOGLE FOUND THE FIRST KNOWN SECURITY BREACH IN SEPTEMBER 2023, FOLLOWED BY GTIG NOTICE OF A STEADY OPERATIONAL TREND.
@firstsquawkGOOGLE REPORTED THAT A THREAT ACTOR TARGETED EXTERNALLY ACCESSIBLE REDCAP SERVERS AND INSTALLED CUSTOM MALWARE NAMED INFINITERED TO STEAL LEGITIMATE REDCAP LOGIN CREDENTIALS.
@firstsquawkGOOGLE IDENTIFIED SEVERAL ORGANIZATIONS IN THE US AND CANADA THAT WERE COMPROMISED BY INFINITERED.
@reutersChinese-linked hackers targeted U.S.,Canadian research facilities for a year, Google says
@thehackersnews🚨 A trusted cloud feature became a spying tool. Google says China-linked hackers breached North American research networks via REDCap, then abused Google Workspace rules to secretly BCC emails matching nearly 150 keywords. Read: https://t
@thecybersechubChinese hackers breached North American research institutions via REDCap servers
@bleepincomputerChinese hackers breach REDCap servers, steal medical research