Google Disrupts Major Chinese State-Linked Cyber Espionage Campaign Targeting Global Telecoms and Governments Google’s Threat Intelligence Group (GTIG), in collaboration with Mandiant and industry partners, has dismantled a large-scale cyber espionage operation attributed to UNC2814, a suspected People’s Republic of China (PRC)-linked threat group active since at least 2017. The campaign breached 53 telecommunications and government entities across 42 countries, with suspected infections in 20 additional nations, spanning Africa, Asia, and the Americas. ### Key Tactics and Tools UNC2814 deployed a new C-based backdoor, GRIDTIDE, which leveraged Google Sheets as a command-and-control (C2) channel to evade detection. Unlike traditional malware, GRIDTIDE abused legitimate Google Sheets API calls, blending malicious traffic with routine cloud activity. The backdoor could execute shell commands, exfiltrate files, and hide data exchanges within seemingly normal spreadsheet interactions. The malware relied on a 16-byte cryptographic key stored on compromised hosts to decrypt Google Drive configurations, including service accounts and private keys. It polled specific spreadsheet cells for commands, returning results in small chunks to avoid triggering security alerts. Initial access often involved exploiting internet-facing systems, such as vulnerable web servers or edge devices. Attackers used SSH and service accounts for lateral movement, deployed SoftEther VPN Bridge for encrypted outbound traffic, and targeted systems containing personally identifiable information (PII), including names, phone numbers, birth details, and national ID numbers. ### Disruption and Impact Google and its partners executed a coordinated takedown of UNC2814’s infrastructure, terminating attacker-controlled Google Cloud projects, sinkholing domains, and revoking access to compromised accounts. Detection signatures tied to the group’s operations since 2023 were released to aid defenders in identifying and removing the threat. While 53 confirmed victims were identified, the campaign’s scope suggests a decade-long effort to surveil strategic targets, including dissidents, activists, and government entities. Historically, similar PRC-linked operations have accessed call detail records, SMS messages, and lawful intercept systems for intelligence gathering. Despite the disruption, GTIG warns that UNC2814 is likely to rebuild its infrastructure using new tools and cloud resources. Affected organizations have received direct notifications and support.

A cyberattack on Monday, [date not specified], targeted multiple high-profile Kenyan government ministry websites, including the Ministries of Interior, Health, Education, Energy, Labour, and Water. The attack defaced these platforms with racist and white supremacist messages (e.g., “We will rise again,” “White power worldwide,” “14:88 Heil Hitler”), disrupting public access for hours. The intrusion was attributed to a group identifying itself as ‘PCP@Kenya’, though no formal claim of responsibility was made. While no sensitive financial data or core government systems were compromised, the incident exposed vulnerabilities in Kenya’s public-sector digital infrastructure, prompting an urgent response from national cybersecurity teams (KE-CIRT). The attack was contained quickly, with systems restored and placed under continuous monitoring. However, the defacement of six key ministries’ websites—critical for public services—raised concerns about reputational damage, public trust erosion, and potential future exploits. No evidence linked the attack to broader regional coordination, though it followed a Somalia e-Visa breach reported 24 hours prior.