Google Workspace feature exploited for data exfiltration

🔑 Enhanced Key Takeaways

•The China-linked espionage group responsible for this campaign is tracked by Google's Threat Intelligence Group (GTIG) as UNC6508.
•Initial access was achieved by exploiting externally facing REDCap (Research Electronic Data Capture) servers, followed by the deployment of custom malware named INFINITERED to harvest legitimate login credentials.
•The exfiltration technique involved abusing Google Workspace's legitimate content compliance rules, which scan emails for specific keywords and silently BCC matching messages to an attacker-controlled Gmail address.
•The earliest identified compromise in this campaign dates back to September 2023, with the group maintaining persistence and activity through November 2025.
•The attackers configured a rule, notably with a misspelled keyword 'Patroit,' to monitor for approximately 150 keywords, search terms, and email addresses related to geo-strategic policy, military strategy, advanced technology (including AI and uncrewed vehicles), offensive cyber programs, and medical research.

📊 Competitor Analysis▸ Show

Feature / Platform	Google Workspace	Microsoft 365
Data Loss Prevention (DLP)	Offers advanced DLP capabilities to define policies and rules for sensitive data.
Multi-Factor Authentication (MFA)	Provides built-in MFA and 2-Step Verification (2SV) for account protection.
Admin Controls for Forwarding	Allows administrators to set up email forwarding rules, disable automatic forwarding for users/OUs, and use compliance rules to block external forwarding.
Audit Logging	Provides Admin Audit logs, Login Audit logs, and can export logs to BigQuery for deeper analysis.
Tenant-wide Visibility of Rules	Admin Console lacks a consolidated, tenant-wide view of all Gmail filters across all users, requiring individual user inspection.
Compliance & Governance	Emphasizes simplicity and cloud-first usability; suitable for organizations with lighter regulatory requirements.
Integrated Endpoint Management	Primarily cloud-native and web-focused; may require third-party integrations for enterprise-scale endpoint management.
Conditional Access Policies	Does not natively include the same level of conditional access policies as Microsoft 365.
Advanced Threat Protection	Includes robust anti-malware and anti-phishing protection.	Offers a more comprehensive security framework through Microsoft Defender, Azure Active Directory, and Microsoft Purview Compliance Manager.
Includes advanced identity protection features and Microsoft's Advanced Threat Protection against sophisticated threats.
Provides comprehensive set of cybersecurity capabilities including Azure Active Directory for identity and access management.
Offers advanced auditing and reporting tools, allowing IT teams to monitor user activity and detect anomalous behavior.
Offers more robust compliance and governance capabilities with more customization via Microsoft Purview Suite; better suited for highly regulated industries.
Includes integrated endpoint management and conditional access policies based on user location, device health, and risk profile.
Integrates with Microsoft Purview and compliance tools for adherence to regulatory frameworks like GDPR, HIPAA, and SOC 2.
Advanced Threat Protection delivers layered security against sophisticated threats, including zero-day exploits and targeted phishing attacks.

🛠️ Technical Deep Dive

Google Workspace routing rules are administrative rules configured in the Google Admin console that modify mail in transit.
Content compliance rules, a feature within Google Workspace, allow administrators to define conditions based on email content (e.g., keywords, search terms, email addresses) and apply actions such as copying or forwarding matching messages.
Attackers gained administrative privileges to create a content compliance rule that silently BCC'd emails matching nearly 150 keywords to an external, attacker-controlled Gmail address.
The Google Admin Console provides interfaces for setting up email forwarding (Apps > Google Workspace > Gmail > End User Access or Routing) and compliance rules (Apps > Google Workspace > Gmail > Compliance).
The Admin Settings API allows programmatic retrieval and modification of domain settings, including email routing, which could be leveraged by attackers with sufficient privileges.
Google Workspace generates audit logs (Admin Audit logs, Login Audit logs) that record administrative actions, including the creation and modification of email filters and routing rules.
A notable gap in the built-in visibility is the lack of a consolidated, tenant-wide view of all Gmail filters across all users in the Admin Console, making it challenging to detect widespread malicious forwarding rules without external tools or extensive manual review.
Organizations can implement controls such as disabling automatic forwarding for all users or specific Organizational Units and configuring compliance rules to block external forwarding to mitigate such risks.

🔮 Future ImplicationsAI analysis grounded in cited sources

Nation-state actors will increasingly weaponize legitimate cloud features for stealthy operations.

The use of built-in features like content compliance rules avoids deploying malware on mail servers and generates no unusual network traffic, making detection harder and setting a precedent for similar abuses.

Organizations will need to enhance their monitoring and auditing capabilities for cloud-native configurations.

Current cloud platform admin tools may lack a consolidated view of all forwarding rules and configurations, necessitating more sophisticated detection and response strategies to identify subtle abuses.

The focus of cloud security will shift further from perimeter defense to identity and configuration management.

Compromised admin credentials, rather than traditional network breaches, enable the abuse of powerful cloud features, highlighting the critical importance of robust identity protection and secure configuration baselines.

⏳ Timeline

2009-06

Operation Aurora: China-linked group targets Google

2023-09

Earliest known compromise in UNC6508 campaign via REDCap servers

2025-02

Google first reports on UNC6508 and its REDCap backdoor

2025-11

UNC6508 campaign activity continues through this month

2026-02

Google disrupts China-linked UNC2814 group abusing Google Sheets API for C2

2026-06-15

Google GTIG publishes report on UNC6508 exploiting Workspace rules

Google Workspace feature exploited for data exfiltration

⚡ 30-Second TL;DR

🧠 Deep Insight

🔑 Enhanced Key Takeaways

🛠️ Technical Deep Dive

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline

📎 Sources (27)

👉Related Updates

Rokarolla Android trojan targets 217 banking and crypto apps

US closes probe into 2024 Delta Air Lines meltdown

Neuron Soundware launches €150 AI drone detection system

ALS patient uses brain implant to speak with 99% accuracy