Attackers hijacked REDCap upgrade processes to plant malware and spy on academic, healthcare, and defense research networks.