Google Disrupts Global Cyberespionage by UNC2814

Google's Threat Intelligence Group, in collaboration with Mandiant and other cybersecurity partners, announced on February 25 the disruption of a long-running global cyberespionage campaign attributed to a suspected Chinese-linked threat actor known as UNC2814. The operation, active since at least 2017, targeted telecommunications and government organizations across Africa, Asia, and the Americas, compromising at least 53 entities in 42 countries and suspected of infecting systems in 20 more.

The campaign, which intensified since 2023, relied on a novel backdoor malware called GridTide to maintain stealthy access. Developed in C, GridTide enabled attackers to execute arbitrary shell commands, upload and download files, and conduct reconnaissance on infected systems. In a sophisticated evasion tactic, the malware used the Google Sheets API for command-and-control communications, blending malicious traffic with legitimate HTTPS requests to cloud services. Attackers stored encoded instructions in spreadsheet cells, which the backdoor polled periodically to receive and execute orders without triggering standard network detection tools. Researchers noted that GridTide authenticated...