Historical intelligence backfill. This assessment covers reporting originally published on 2026-06-15 and was added to the RWP archive on 2026-09-07.

Daily Top · Nation-State

UNC6508 spent a year in North American medical research — REDCap was the door, defense intel was the take

GTIG 15 June 2026 — PRC-nexus UNC6508. Externally facing web apps, bespoke malware, admin tools for quiet exfil. Collection: AI, uncrewed systems, offensive cyber, Indo-Pacific ops, medical research. One REDCap from Sep 2023 through Nov 2025.

RWP Ventures · 2026-09-07 · event 2026-06-15 · 1 min read · priority 8.4

Bottom line up front

CONFIRMED 15 June 2026 GTIG — UNC6508, PRC-nexus, against North American academic, medical, and military-research institutions. Undetected over a year. Chain: compromise internet-facing web apps, bespoke malware, pivot to sensitive internals, abuse enterprise admin tools for covert exfil. Collection list is not “PHI for fraud”: national-security defense intel, Indo-Pacific command operations, AI, uncrewed vehicles, offensive cyber programs, and medical research. Victim class: clinical providers, academic centers, military health, advocacy groups, regulators.

Worked example: a medical-research university REDCap server compromised September 2023, activity through November 2025. That is a clinical-trial database as a beachhead, not a hospital PLC.

Do not brief this as a healthcare ransomware story.

What happened

Long dwell, living off admin tooling. The research network is the prize because it sits next to DoD-funded work.

Why it matters

REDCap and similar research stacks are often “the science team’s app” with a public URL and a thin patch cycle.

What is confirmed vs not

CONFIRMED GTIG attribution, dwell, REDCap example, collection themes.

UNKNOWN public victim names.

What defenders should do

Inventory internet-facing research apps (REDCap, LIMS, faculty CMS) as Tier-1.
Assume 12+ month dwell; 90-day logs will miss the door.
Segment military-adjacent research from the hospital EMR — different blast radius.

RWP assessment

Confidence: High on GTIG’s campaign. This is collection against the U.S. science base, not “hospital hacked.”