Google Disrupts Chinese Hackers Infrastructre which Breached 53 Telecom and Government Entities
## Cybersecurity: Disruption of UNC2814 Espionage Campaign
Cybersecurity: Disruption of UNC2814 Espionage Campaign
A cyber espionage operation, attributed to a suspected Chinese state-linked group, has been disrupted by Google. The operation targeted telecommunications and government entities across four continents over nearly a decade.
Google's Threat Intelligence Group (GTIG) and Mandiant collaborated to dismantle this campaign, which involved a threat actor identified as UNC2814, linked to the People’s Republic of China (PRC). By February 18, 2026, 53 victims had been identified across 42 countries.
The campaign utilized a previously undocumented backdoor named GRIDTIDE. Instead of traditional command servers, GRIDTIDE routed communications through Google Sheets, disguising malicious traffic as normal cloud activity. This tactic made detection by standard network defenses challenging.
GRIDTIDE was identified after suspicious activity was detected on a CentOS Linux server. A binary named /var/tmp/xapt was discovered, which had been used to gain root-level access and execute commands. This binary was designed to mimic a common system tool, aiding in evading detection.
A cyber espionage operation, attributed to a suspected Chinese state-linked group, has been disrupted by Google.
UNC2814 ensured persistence by embedding GRIDTIDE as a systemd service. The malware utilized the nohup command to maintain operation beyond the termination of the attacker's session. Additionally, SoftEther VPN Bridge was deployed as a secondary communication channel, establishing an encrypted connection to external infrastructure.
GRIDTIDE, a C-based backdoor, executed shell commands, uploaded files, and exfiltrated data. It employed a 16-byte AES-128 encryption key for Google Drive configuration access, which contained service account credentials and Spreadsheet ID for command-and-control (C2) communication.
Monitor outbound HTTPS connections to Google Sheets API endpoints for suspicious activity. Check for systemd services in unexpected directories and binaries in /var/tmp/ . Look for SoftEther VPN components on Linux servers. Apply GTIG’s published YARA rules for GRIDTIDE and cross-reference internal logs with released indicators of compromise (IOCs).
These measures will assist in identifying and mitigating any remaining exposure from this espionage campaign.
Based on reporting by Cyber Security News.