UNC6508 is a China-linked cyber espionage group that compromised REDCap research servers and abused Google Workspace content compliance rules to exfiltrate sensitive emails from North American medical, academic, and military institutions. Active from September 2023 to November 2025, the group deployed INFINITERED malware and used domain admin access to create stealthy mail forwarding rules.