The majority of internet-accessible REDCap servers are running outdated software versions, making them prime targets for state-sponsored threat actors, according to internet intelligence firm Censys.
A browser-based platform used for building and managing clinical research data in the medical field, REDCap is developed by Vanderbilt University and is used by academic, healthcare, and non-profit organizations.
According to a June report by Google’s Threat Intelligence Group (GTIG), legacy REDCap servers are routinely targeted by a China-linked threat actor tracked as UNC6508 for cyberespionage purposes.
Beginning in September 2023, as part of a campaign aimed at major medical, academic, and military research organizations in the US, the threat actor hacked web-facing REDCap servers and deployed custom malware for login credential harvesting.
In one instance, the attackers deployed the InfiniteRed backdoor three months after the initial intrusion. One year after remaining undetected, the hacking group used the harvested credentials to access the organization’s internal network and exfiltrate data.
GTIG could not confirm how UNC6508 compromised the REDCap server, but believes that the attackers probed vulnerable legacy versions on several systems, taking advantage of REDCap’s design that “allows administrators to continue running legacy software side-by-side with the current version.”
According to a fresh Censys report, there are approximately 8,500 internet-exposed REDCap instances globally, but just over 1% of them run the latest version available. Nearly a third (30%) of the observed instances run REDCap version 16.0.17, followed by version 16.1.4 at 4.93% and version 16.0.15 at 3.34%.
“It’s unclear from REDCap’s website when each of these versions was released, but the existence of 17.x.x releases suggests that 16.x.x versions may be somewhat outdated. 17.1.3 appears to be the latest version available, and only 1.18% of instances are running this patch version as of June 16, 2026,” the internet intelligence provider says.
Internet-accessible REDCap servers are spread across 100 countries, with approximately 40% of them in the US. The UK (7.4%), Germany (4.8%), and Australia (3.9%) also expose numerous deployments to the web.
Considering state-sponsored threat actors’ interest in REDCap servers, organizations are advised to create an inventory of their instances, ensure they run a patched version, and follow the vendor’s recommendations to keep the web server and database server separate, with the database secured behind a firewall.
Related: Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack
Related: Atlassian, Splunk Patch Critical Vulnerabilities
Related: Atomic Arch Supply Chain Attack Hits 1,500 AUR Packages
Related: No Exploits Required
