Attributed metadata history
Up to 100 retained publisher events per page for b1c794aeb95f3166cf9895d419ba0aadb6b77de2192d98add52345f368c569b2. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_029e2f07006b78ebcb
observed · 2026-10-12 05:29:01 UTC
Written by: Patrick Whitsell, John McGuiness, Muhammad Umair Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromised externally facing web applications, deployed bespoke malware, pivoted to sensitive internal systems, and abused enterprise administrative tools for covert data exfiltration. The threat actor had broad collection aspirations, including sensitive defense intelligence related to national security, Indo-Pacific command operations, artificial intelligence, uncrewed vehicle systems, cyber offensive programs, and medical research. GTIG disrupted the malicious infrastructure associated with this threat actor. Working with Mandiant Consulting, we notified the affected organizations upon detection and offered our assistance with remediation. We have updated Google Security Operations (SecOps) with relevant intelligence, enabling defenders to identify indicators of compromise (IOCs) within their networks. We
Fingerprint: ad75fde5b372880e91ce3e0a3877f70d848e6ce7ff240779fe9f337f34392371
intelligence_src_029e2f07006b78ebcb
observed · 2026-10-12 05:29:01 UTC
available
Fingerprint: e71aa6d523741f9f527f5071fd96527dbb781bc01e36c89fd9ec28cdb29f734f