{"id":60873,"date":"2026-06-15T14:00:00","date_gmt":"2026-06-15T14:00:00","guid":{"rendered":"https:\/\/www.theregister.com\/a\/5254547"},"modified":"2026-06-15T14:00:00","modified_gmt":"2026-06-15T14:00:00","slug":"prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/","title":{"rendered":"PRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data"},"content":{"rendered":"
<\/div>\n
\n

RESEARCH<\/p>\n

Google says the intruders were on the hunt for everything from drone tech to pathogens<\/p>\n<\/p><\/div>\n

\n

Chinese government spies remained hidden in the networks of multiple North American medical and military research organizations for more than a year, deploying custom malware and snooping through Gmail inboxes and stealing sensitive data. <\/p>\n

This PRC-nexus espionage crew, which Google tracks as UNC6508<\/a>, used some particularly noteworthy search terms as they were scanning for data to steal. They included such esoteric topics as drone technology and a viral disease that spreads from mosquitoes to humans.<\/p>\n

\u201cIt\u2019s one of the most interesting grocery shopping lists of things to collect that I\u2019ve seen from a state-sponsored actor,\u201d Luke McNamara, deputy chief analyst at Google Threat Intelligence Group, told The Register<\/span>. <\/p>\n

\u201cWe have defense-related activity, which was a significant bulk of the different terms, or emails related to defense platform systems or companies,\u201d McNamara said. \u201cSome of those were looking for any emails that were coming in or going out that used @ and then a big defense name. Others were specific email addresses of individuals at more niche defense companies.\u201d<\/p>\n

While most of the terms related to defense and technology, the intruders also searched for some medical research facilities \u2013 and the very specific pathogen, \u201cChikungunya<\/a>,\u201d a viral disease transmitted to humans from mosquitoes that was responsible for an outbreak in China’s Guangdong province in July 2025.<\/p>\n

Google won\u2019t say how many organizations were compromised in this campaign. A Monday report said the operation targeted several national, state, and private medical entities. <\/p>\n

\u201cThese organizations comprise world-renowned clinical providers, premier academic centers, North American military health institutions, professional advocacy groups, and health regulatory bodies,\u201d according to the report. \u201cTheir research areas span a broad spectrum of modern medicine, from molecular discovery and clinical drug trials to state-level public health policy and military readiness.\u201d<\/p>\n

\n
\n

MORE CONTEXT<\/h2>\n<\/p><\/div>\n<\/div>\n

McNamara told us that the tech company\u2019s incident responders notified all the victims they identified, \u201cand we suspect there’s probably even more.\u201d<\/p>\n

Incident responders first detected this campaign in early 2025, but told us it dates back to at least 2023. And all of these attacks began with the digital intruders somehow exploiting externally facing REDCap (Research Electronic Data Capture) servers. These servers are primarily used by universities, hospitals, and research institutions to build and manage online databases and surveys, and to store sensitive clinical research data.<\/p>\n

The earliest known intrusion happened in September 2023, when UNC6508 compromised a REDCap server belonging to a North American medical research institution. McNamara told us that all of the intrusions followed this same pattern. <\/p>\n

Seeing (Infinite)Red<\/h3>\n

After three months, the snoops silently deployed custom malware named InfiniteRed to capture legitimate REDCap login credentials.<\/p>\n

The malware includes three modular components. The first allows it to maintain persistent remote access by injecting its code into new REDCap versions after intercepting the upgrade process. Then it injects a credential harvester into the authentication system file to compromise user accounts. Finally, it functions as a backdoor with custom hooks that executes on every REDCap page load.<\/p>\n

Google\u2019s threat intelligence team identified \u201cmultiple\u201d US and Canada-based organizations infected with InfiniteRed, and offered assistance with removing the malware.<\/p>\n

After remaining undetected for more than a year, UNC6508 used the stolen credentials to access admin accounts and the victims\u2019 internal network. Finally, the attackers added sneaky domain content compliance rules for data theft.<\/p>\n

All ‘Patroit’ themed emails sent to BebitaBarefoot774<\/h3>\n

Content compliance rules are legitimate features in many cloud-based enterprise productivity suites – like Google Workspace – to exfiltrate specific email communications. Administrators can create these rules to manage messages that contain predefined sets of words or phrases, and these rules apply to all of the users in an organizational unit.<\/p>\n

UNC6508 created a compliance rule named “Patroit” (yes, they misspelled \u201cPatriot\u201d) to match keywords and email address patterns in sent or received emails. <\/p>\n

These messages were then silently BCC-forwarded to an attacker-controlled Gmail address, BebitaBarefoot774[@]gmail[.]com, delivering a steady stream of geo-strategic policy, military strategy, advanced technology, and medical research emails to the PRC-linked crew. The search terms also included professional email addresses and phone numbers for members of organizations in these spaces. <\/p>\n

GTIG disabled the Gmail account to prevent further data exfiltration.<\/p>\n

\u201cOne of the questions that we’ve had internally around this is: We’re seeing this show up primarily at medical research institutions,\u201d McNamara said. \u201cWhy are they searching for things like unmanned drones and unmanned vehicles? Why would you expect to find that there?\u201d<\/p>\n

One theory, he said, is that this particular threat group was tasked with collecting data across different categories of national-security-related terms and information. \u201cMaybe they were copy-and-pasting this across multiple victims, including ones outside of this medical research space?\u201d<\/p>\n

Plus, some of the targeted institutions were likely working on research with a military or government agency connection. \u201cSo there was a potential that they could be in correspondence with someone where one of these terms showed up, and the actors were casting a very wide net,\u201d McNamara said.\u00ae<\/p>\n<\/p><\/div>\n

READ MORE HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Google says the intruders were on the hunt for everything from drone tech to pathogens READ MORE HERE…<\/p>\n","protected":false},"author":2,"featured_media":60874,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[842],"class_list":["post-60873","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-register","tag-research"],"yoast_head":"\nPRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-15T14:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/image.theregister.com\/1681600.jpg?imageId=1681600&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"PRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data\",\"datePublished\":\"2026-06-15T14:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/\"},\"wordCount\":866,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data.jpg\",\"keywords\":[\"Research\"],\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/\",\"name\":\"PRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data.jpg\",\"datePublished\":\"2026-06-15T14:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data.jpg\",\"width\":100,\"height\":66},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Research\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/research\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"PRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/","og_locale":"en_US","og_type":"article","og_title":"PRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2026-06-15T14:00:00+00:00","og_image":[{"url":"https:\/\/image.theregister.com\/1681600.jpg?imageId=1681600&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"PRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data","datePublished":"2026-06-15T14:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/"},"wordCount":866,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/06\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data.jpg","keywords":["Research"],"articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/","url":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/","name":"PRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/06\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data.jpg","datePublished":"2026-06-15T14:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/06\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2026\/06\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data.jpg","width":100,"height":66},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/prc-linked-spies-hid-inside-medical-and-military-networks-for-more-than-a-year-snooping-through-gmail-and-stealing-data\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Research","item":"https:\/\/www.threatshub.org\/blog\/tag\/research\/"},{"@type":"ListItem","position":3,"name":"PRC-linked spies hid inside medical and military networks for more than a year, snooping through Gmail and stealing data"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/60873","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=60873"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/60873\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/60874"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=60873"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=60873"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=60873"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}