Google’s Threat Intelligence Group has disclosed a sustained PRC-linked espionage campaign by UNC6508 that operated undetected for over a year inside North American medical, academic, and military research institutions. The group exploited REDCap research data platforms to gain initial access, deployed custom persistence malware called INFINITERED, and exfiltrated sensitive data by manipulating enterprise email compliance rules, a technique not previously widely documented in public threat intelligence. Organizations conducting defense research, Indo-Pacific policy analysis, AI development, uncrewed vehicle programs, or clinical medical research face the highest risk of prior or ongoing compromise.