A China-linked group backdoored REDCap servers at US and Canadian medical and military research institutions, then used Google Workspace to exfiltrate email.