[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvAio-1tzPg1V2VwjKGqVmwD0o2ZScFsUYvE76Xxz-ZU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":44,"controls":45},"8c75b098-a191-4b40-9c16-1734b5c537aa","outdated-redcap-servers-targeted-by-chinese-espionage-actors","02a349b8-f3af-4a8e-bf08-6b98a369b2fd","Outdated REDCap Servers Targeted by Chinese Espionage Actors","A large proportion of internet-accessible REDCap servers — widely used in academic and medical research — are running outdated, vulnerable software versions, creating an easy target for sophisticated threat actors. China-linked group UNC6508 has exploited these unpatched systems to deploy custom backdoors like InfiniteRed, stealing credentials and exfiltrating sensitive research data. The failure to maintain current patch levels on internet-facing systems is a fundamental security hygiene lapse that dramatically lowers the cost of attack for adversaries. This incident underscores that research organizations handling sensitive data must treat patch management as a critical operational priority, not an afterthought. Exposure of research data to state-sponsored espionage can compromise intellectual property, national security interests, and the integrity of clinical or scientific findings.","**Immediate actions:**\n- Audit all internet-facing REDCap instances and upgrade them to the latest supported version immediately.\n- Restrict public internet access to REDCap servers using firewall rules or VPN-only access where operationally feasible.\n- Scan all REDCap hosts for indicators of compromise related to InfiniteRed and UNC6508 TTPs.\n\n**Long-term improvements:**\n- Establish an automated patch management program that prioritizes internet-facing and research-critical applications.\n- Maintain a continuously updated inventory of all externally accessible assets, including application versions and patch status.\n- Implement network segmentation to isolate REDCap and other research platforms from broader institutional networks.\n\n**Detection measures:**\n- Deploy continuous vulnerability scanning tools (e.g., Tenable, Qualys) configured to alert on outdated software versions in internet-exposed systems.\n- Enable detailed logging and behavioral monitoring on REDCap servers to detect credential harvesting and anomalous data access patterns.\n- Integrate threat intelligence feeds covering state-sponsored actors to proactively identify targeting of research infrastructure.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection","NIST AC-17: Remote Access","GDPR Article 32: Security of Processing (for EU research data)","HIPAA §164.308(a)(5): Security Awareness and Training \u002F Patch Management","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{},"published","2026-06-18T18:20:35.222206+00:00","2026-06-18T18:20:35.116+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.securityweek.com\u002Fmajority-of-internet-accessible-redcap-servers-outdated\u002F","majority-of-internet-accessible-redcap-servers-outdated-ce5475","Majority of Internet-Accessible REDCap Servers Outdated",[32,38],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[46,49,53],{"slug":35,"name":47,"problem":48},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":50,"name":51,"problem":52},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",{"slug":41,"name":54,"problem":55},"Automated patch management","Known holes get closed in days, not months."]