[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOMP6nU9foAiG6U2sVtzWv1DhehxhZatvPjSxXGwhdys":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"02a349b8-f3af-4a8e-bf08-6b98a369b2fd","Majority of Internet-Accessible REDCap Servers Outdated","majority-of-internet-accessible-redcap-servers-outdated-ce5475","These servers are regularly targeted by China-linked UNC6508 for initial access and backdoor deployment. The post Majority of Internet-Accessible REDCap Servers Outdated appeared first on SecurityWeek.","A significant number of internet-facing REDCap servers are running outdated software, making them vulnerable to exploitation. China-linked threat actor UNC6508 has been actively targeting these servers for cyberespionage, deploying custom malware and backdoors like InfiniteRed to harvest credentials and exfiltrate data from research organizations.","Majority of internet-accessible REDCap servers are outdated and targeted by China-linked UNC6508.","https:\u002F\u002Fwww.securityweek.com\u002Fmajority-of-internet-accessible-redcap-servers-outdated\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F04\u002FVulnerability-Databases.jpg","2026-06-18T17:07:48+00:00","2026-06-18T18:00:23.111581+00:00",8,[17,20,23,26],{"name":18,"type":19},"UNC6508","threat_actor",{"name":21,"type":22},"Vanderbilt University","vendor",{"name":24,"type":25},"RECap","product",{"name":27,"type":22},"Google","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[50],{"type":48,"value":51,"context":52},"InfiniteRed","Custom backdoor deployed by UNC6508",[27,21,24],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":86,"name":87,"problem":88,"products":89},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xpanse","Cortex Xpanse","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xpanse","External attack surface discovery and remediation.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":115,"name":116,"problem":117,"products":118},"patch-management","Automated patch management","Known holes get closed in days, not months.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[144],{"slug":145,"name":27,"logo_path":146,"roles":147},"google","\u002Fvendor-logos\u002Fgoogle.png",[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":165},"outdated-redcap-servers-targeted-by-chinese-espionage-actors","Outdated REDCap Servers Targeted by Chinese Espionage Actors","A large proportion of internet-accessible REDCap servers — widely used in academic and medical research — are running outdated, vulnerable software versions, creating an easy target for sophisticated threat actors. China-linked group UNC6508 has exploited these unpatched systems to deploy custom backdoors like InfiniteRed, stealing credentials and exfiltrating sensitive research data. The failure to maintain current patch levels on internet-facing systems is a fundamental security hygiene lapse that dramatically lowers the cost of attack for adversaries. This incident underscores that research organizations handling sensitive data must treat patch management as a critical operational priority, not an afterthought. Exposure of research data to state-sponsored espionage can compromise intellectual property, national security interests, and the integrity of clinical or scientific findings.",[154,155,156,157,158,159,160,161,162,163,164],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection","NIST AC-17: Remote Access","GDPR Article 32: Security of Processing (for EU research data)","HIPAA §164.308(a)(5): Security Awareness and Training \u002F Patch Management","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]