Chinese Hackers Breach REDCap Servers, Steal Medical Research Data

China-Linked APT Targets Medical Research Infrastructure

A sophisticated China-linked espionage campaign has been identified targeting REDCap (Research Electronic Data Capture) servers, exploiting exposed instances to deploy a previously undocumented malware family called InfiniteRed and steal sensitive medical research data from at least one North American institution.

REDCap is a widely used, web-based application for building and managing online surveys and databases — it is particularly prevalent in clinical research, healthcare studies, and biomedical data collection at universities, hospitals, and research institutions globally. Its prevalence in high-value research environments makes it an attractive target for state-sponsored threat actors.

Attack Chain

The campaign exploited internet-exposed REDCap server instances — a known risk in research environments where self-hosted deployments may lack enterprise-grade security controls. The attack chain involved:

1. Initial Access — Identification and exploitation of exposed REDCap instances, likely through vulnerability scanning and credential attacks against publicly accessible web interfaces.
2. Malware Deployment — Installation of InfiniteRed, a previously unknown implant designed for persistent access and data exfiltration.
3. Data Collection — Targeting of research databases, clinical trial records, and associated sensitive data stored within the REDCap environment.
4. Exfiltration — Covert transfer of stolen research data to attacker-controlled infrastructure.

InfiniteRed: New Malware Family

InfiniteRed is the designation for the malware deployed in this campaign, representing a novel implant attributed to this China-linked threat actor. While full technical analysis is still emerging, malware of this type in state-sponsored espionage operations typically provides:

• Persistent access via scheduled tasks, service installation, or web shells
• Command-and-control (C2) communication over encrypted channels to blend with legitimate traffic
• Data staging and exfiltration capabilities targeting specific file types and database records
• Anti-detection evasion to persist undetected in research environments with limited EDR coverage

The "InfiniteRed" naming (with its potential echo of the REDCap platform it targets) may reflect a campaign-specific tool or variant developed for this particular espionage operation.

Why REDCap?

REDCap servers are particularly valuable to nation-state actors because they may contain:

• Clinical trial data — drug efficacy, outcomes, and proprietary pharmaceutical research
• Biomedical research results — pre-publication findings of significant scientific value
• Patient-linked research records — de-identified or identifiable clinical data
• Institutional intellectual property — years of research investment in a single database

For China-linked threat actors, stealing medical and pharmaceutical research is consistent with a documented long-term strategy of technology and IP transfer to support domestic industry and reduce dependence on foreign research outputs.

Broader Context: Chinese APT Healthcare Targeting

This campaign is part of a well-established pattern of Chinese state-sponsored actors targeting the healthcare and research sector:

• APT10 / Cloud Hopper — targeted managed service providers to access pharmaceutical clients
• Hafnium — exploited Exchange servers at infectious disease researchers during COVID-19
• Salt Typhoon — active in telecommunications infrastructure with healthcare-adjacent exposure
• Various unnamed clusters targeting oncology, vaccine, and biodefense research

The targeting of exposed web applications in research environments reflects an understanding that academic and research institutions often have less mature security postures than large commercial enterprises, despite holding data of equivalent strategic value.

Mitigation for REDCap Administrators

Institutions running REDCap deployments should take immediate action:

1. Audit public exposure — confirm whether your REDCap instance is internet-accessible and restrict access to VPN or institution networks only.
2. Patch immediately — ensure REDCap and all underlying components (PHP, MySQL/MariaDB, web server) are running current versions.
3. Review authentication — enforce strong passwords and MFA on all REDCap administrator and user accounts.
4. Check for web shells — scan the REDCap web root for unexpected PHP files that could indicate web shell implants.
5. Monitor outbound traffic — look for unusual data transfers or connections to non-institutional IPs from the REDCap server.
6. Review database access logs — look for bulk SELECT queries or mass data exports inconsistent with normal usage.
7. Engage your CSIRT — if compromise is suspected, initiate incident response procedures and consider forensic imaging before remediation.

Reporting a Compromise

Institutions in the United States suspecting compromise should report to:

• CISA: cisa.gov/report
• FBI IC3: ic3.gov
• HHS OCR (if PHI is involved): hhs.gov/hipaa

Source: BleepingComputer. Published June 15, 2026.