ctrlINT What the industry said about every indicator, with the quote

UNC6508Threat actor

UNC6508 is a PRC-nexus threat actor targeting North American academic, medical, and military research institutions, employing tactics such as exploiting REDCap servers and deploying custom malware named INFINITERED. The actor utilized credential harvesting, internal reconnaissance, and a web shell named "help.php" for persistence.From MISP Galaxy

Last reported 1 month ago, by Google Threat Intelligence3 reports

Suspected originChinaMISP Galaxy

ATT&CK techniques

6 of 22 · each with the sentence it comes from
  1. T1195Supply Chain Compromise

    “…g multiple tactics to trick AI coding assistants and large language model (LLM) security scanners into its open source software supply chain compromises.”

    Google Threat IntelligenceVendor
  2. T1020Automated Exfiltration

    “Use of content compliance rules ("Patroit") for automated exfiltration.”

    Google Threat IntelligenceVendor
  3. T1027Obfuscated Files or Information

    “T1027”

    Google Threat IntelligenceVendor
  4. T1027.007Dynamic API Resolution

    “Supply source code to Gemini to implement evasion and obfuscation tactics and consolidate foothold (e.g., dynamic API resolution via PEB parsing, rolling XOR encryption of C2 IP addresses).”

    Google Threat IntelligenceVendor
  5. T1036Masquerading

    “Masquerading CI/CD Pipeline Tasks as Legitimate AI Utilities”

    Google Threat IntelligenceVendor
  6. T1055Process Injection

    “…g assistants such as DeepSeek-Coder to develop Python-based Remote Access Trojans (RATs) incorporating cross-platform persistence, process injection, fileless execution, defense evasion, and C2 notifications.”

    Google Threat IntelligenceVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

3 reports, newest first · the exact sentence from each

  1. “In June 2026, GTIG reported on a multi-year cyber espionage campaign by UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting academic, medical, and military research institutions in North America.”

    Google Threat IntelligenceVendor
    GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

  2. “In one example of this activity, GTIG has observed a cyber-espionage campaign by a Chinese nation-state actor tracked as UNC6508, which specifically targets proprietary AI research in academic, medical and military research institutions in North America.”

    Infosecurity MagazineNews
    AI Coding Tools Now a Prime Target for Threat Actors, Google Warns

  3. “Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community.”

    Google Threat IntelligenceVendor
    Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research

Indicators in its reports

named in the reports above
Copy these 8 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with UNC6508 here?
No account needed. We do not store your IP address.