INTEL_REPORT
Mandiant / Google Threat Intelligence Blog · published 6/15/2026, 2:00:00 PM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromis…
https://cloud.google.com/blog/topics/threat-intelligence/prc-targets-us-medical-research
sha256:2767829efedf92debe5b87ae6621733855e57b54f0b05fddaa43f8402dc55588
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
| Type | Value | Link |
|---|---|---|
| domain | gmail.com | Open → |
| domain | help.php | Open → |
| domain | upgrade.php | Open → |
| sha256 | ba6b73b0ca0dc7f86b3b397893ac32d729fd53f9df20643288f141f29d020af7 | Open → |
| sha256 | db65c1b9f9e4cb4d729f45ad4b6fcf3e277caf9eb4c875425dec93fd883f9136 | Open → |
| sha256 | c1ac43d23f89d41eb4ff131678ab562ab2cfed9aa334b13767ef141d303b0e5b | Open → |
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.
Neighborhood from the first linked indicator.
| sha256 | 8f0158855a656b629ca76ebca565f18bc25563ded34b65d6771632c20edb68ec | Open → |
| sha256 | 51a57bfc9ed3eb6451c1c289607814d59e1698c666fb97ac5f694c398f23d045 | Open → |
| sha256 | 4efbef69eb3b09bacff892d6a55778d07c418e7f15eba3cf1245e8cdfd8dda0b | Open → |
| sha256 | 58bb25777e0aa86bcd2125101e0bca4e8732b03d91bd8d2f205b446a2a8d5c86 | Open → |