About this episode

The episode discusses a state-sponsored cyber attack that exploited a REDCap vulnerability and how phishing-resistant MFA could have prevented it.

Phishing-resistant MFA could have stopped a Chinese state-sponsored threat actor from spending over a year inside North American academic and medical research networks — and we're going to tell you exactly how it happened and what you need to do about it. A group called UNC5608, tracked by Google's Threat Intelligence Group (GTIG), exploited a vulnerability unique to REDCap — a research data platform that allows multiple software versions to run simultaneously. They got in via stolen admin credentials, planted custom malware called Infinite.red directly into REDCap's upgrade process, harvested credentials for over a year, then used those credentials to log into Google Workspace as a domain admin and create fake compliance rules to silently forward sensitive research emails — military strategy, geostrategic policy, advanced tech, specific pathogens — straight to Gmail accounts they controlled. And nobody noticed for a very long time. Prasanna and I break down the full attack chain, then walk through every prevention layer that could have stopped it: inventory management, patching, password hygiene, SSO, phishing-resistant MFA, passkeys, DBSC, context-aware access, compliance rule…

People in this episode

Host: W. Curtis Preston

Guest: Prasanna

Topics covered

• phishing-resistant MFA
• cybersecurity
• REDCap vulnerability
• credential harvesting
• malware
• data protection
• research networks

Keywords

• phishing
• MFA
• cyber attack
• REDCap
• malware
• credential theft
• Google Workspace
• UNC5608
• data security
• research networks

Mentioned in this episode

Organizations: Google, Google's Threat Intelligence Group, REDCap, Google Workspace, UNC5608

Places: North America, Gmail

More episodes of The Backup Wrap-Up

• Ransomware Response Checklist: Prevent It, Slow It, Survive It · July 20, 2026 · 36 min
• How to Protect Backups from Ransomware (Encore) · July 13, 2026 · 43 min
• What Is Data Deduplication? (Encore) · July 6, 2026 · 46 min
• California Election Fraud? (Pt 2) · June 15, 2026 · 36 min

Explore listener stats, chart rankings, contacts and more on the The Backup Wrap-Up podcast page.