Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails

Summary: A China-linked group Google tracks as UNC6508 hid in North American medical, academic, and military research networks for more than a year, entering through a backdoor on externally facing REDCap research servers that stole login credentials. The group then abused Google Workspace content compliance rules - a rule misspelled "Patroit" watching nearly 150 keywords - to silently BCC matching email to an attacker-controlled Gmail address, with the earliest known compromise dating to September 2023 and activity continuing through November 2025.
What's compelling: The exfiltration used no malware on the mail server and no unusual network traffic - just a built-in Workspace feature turned against the organization, and Google says it had not seen a China-linked actor use domain content compliance rules this way before. Google still does not know how UNC6508 first reached the REDCap servers, so the mail rule is the part defenders can actually audit.

Read the original at The Hacker News ↗

Topics: Detection & Response
Related: YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026
Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026