UNC6508
UNC6508 is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 4 sectors, including Government, and Education and Research, in the United States and Canada. It uses 8 MITRE ATT&CK techniques.
- Techniques
- 8
- Exploited CVEs
- No CVE data
- First seen
- Sep 1, 2023
- Last seen
- Nov 1, 2025
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
8 techniques across 6 of 14 tacticsReconnaissance1
Establish Accounts: Email Accounts
Resource Development·
Initial Access3
Valid Accounts
Exploit Public-Facing Application
Server Software Component: Web Shell
Execution·
Persistence·
Privilege Escalation·
Defense Evasion·
Credential Access1
Unsecured Credentials: Credentials In Files
Discovery·
Lateral Movement·
Collection1
Email Collection: Email Forwarding Rule
Command and Control1
Proxy: Multi-hop Proxy
Exfiltration1
Exfiltration Over Web Service
Impact·
Arsenal · Malware And Tools.
- INFINITEREDmalware
Indicators Of Compromise.
TLP:CLEAR3 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout UNC6508.
UNC6508 is an espionage-motivated threat cluster that has targeted the North American medical and research community, including medical research institutions, premier academic centers, clinical providers, military health institutions, professional advocacy groups and health regulatory bodies in the United States and Canada. The group exploits internet-facing REDCap research data capture servers, including by probing for vulnerable legacy versions kept alongside current installations, deploys a web shell and the custom PHP malware INFINITERED, which trojanizes legitimate REDCap files to survive upgrades, harvest login credentials and provide a cookie-based backdoor.
Harvested credentials were later replayed against an enterprise administrator account to create a mail content compliance rule that silently BCC-forwarded matching emails to an actor-controlled webmail account. Activity has been observed from September 2023 through November 2025; these dates are reported at month-level precision.
Last updated Oct 27, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.