Google Disrupts Major Chinese Cyber Espionage Campaign Targeting Global Telecom and Government Sectors Google’s Threat Intelligence Group (GTIG), alongside Mandiant and other partners, recently dismantled a large-scale cyber espionage operation linked to the Chinese hacker group UNC2814. Active since 2017 and suspected of operating under the People’s Republic of China (PRC), the group targeted 53 victims across 42 countries on four continents, focusing on telecom and government organizations. The campaign relied on GRIDTIDE, a novel malware that exploited the Google Sheets API for command-and-control (C2) communications. By embedding malicious activity within legitimate API traffic, the malware evaded detection while exfiltrating sensitive data, including personally identifiable information (PII) such as names, phone numbers, and national ID numbers. GRIDTIDE provided persistent access to compromised systems, allowing attackers to maintain control and execute further operations. In a coordinated response, GTIG and its partners terminated attacker-controlled Google Cloud Projects, disabled the Google Sheets API infrastructure used for C2, and blocked malicious traffic. The team also released Indicators of Compromise (IOCs), including malicious domains and IP addresses, to help organizations detect and mitigate similar threats. The group’s primary objective appeared to be intelligence collection, with a focus on monitoring communications within targeted sectors. GRIDTIDE’s use of Google Sheets for C2 leveraging cryptographic keys to send commands, transfer files, and execute operations highlighted the growing sophistication of cyber espionage tactics. While the disruption is expected to hinder UNC2814’s operations, experts caution that the group may attempt to reestablish access. The incident underscores the increasing complexity of defending against advanced persistent threats (APTs), particularly as attackers exploit legitimate cloud services to bypass traditional security measures.