A China-linked threat actor, UNC6508, has been conducting a cyber espionage campaign targeting US and Canadian research environments for over a year, exploiting legacy vulnerabilities in the widely-used REDCap platform1. The attackers intercepted REDCap's upgrade process to inject persistence malware, allowing them to maintain access to sensitive research data. The campaign focused on academic institutions, medical research centers, healthcare providers, and military healthcare organizations. Google's Threat Intelligence Group (GTIG) has disrupted the campaign, but not before the attackers had gathered valuable intelligence. The use of legacy REDCap exploits highlights the importance of keeping software up-to-date and patching known vulnerabilities. This campaign matters to security practitioners because it demonstrates the ongoing threat of state-sponsored espionage to research institutions, making it essential to prioritize the security of sensitive data and stay vigilant against such threats.