CSO Online

Google Cloud

The Register

<h1>Disruption of the UNC2814 Cyber Espionage Campaign Utilizing Google Sheets</h1>
<p>The Google Threat Intelligence Group (GTIG), in collaboration with Mandiant and other industry partners, has successfully disrupted a sophisticated global cyber espionage operation conducted by UNC2814, a threat actor believed to be linked to China. Active since 2017, the group orchestrated an espionage campaign that affected 53 organizations across 42 countries, predominantly targeting telecommunications providers and government agencies.</p>
<h2>The GRIDTIDE Backdoor</h2>
<p>At the heart of the operation was a novel C-based backdoor, known as GRIDTIDE, which ingeniously used Google Sheets as its command-and-control (C2) channel. This approach allowed the group to mask their malicious activities within normal API traffic, thereby evading detection. GRIDTIDE regularly polled a Google spreadsheet for shell commands and wrote stolen data into cells, masquerading these actions as legitimate cloud application interactions.</p>
<p>The backdoor was capable of executing shell commands, uploading and downloading files, and utilized AES-128 CBC encryption for secure communication. The campaign’s primary focus was the exfiltration of sensitive personally identifiable information (PII) including names, phone numbers, voter IDs, and national ID numbers.</p>
<h2>Response Actions</h2>
<p>In response to the campaign, GTIG took decisive measures to dismantle the operation. These included the termination of attacker-controlled Google Cloud projects, disabling of malicious accounts, sinkholing of command-and-control domains, and notifying affected victims. Furthermore, GTIG released Indicators of Compromise (IOCs) and YARA rules to aid in detection and defense against similar threats.</p>
<p>The attackers initially gained access through the exploitation of web servers, then moved laterally using SSH, escalated privileges, and established encrypted outbound connections through SoftEther VPN Bridge. The ultimate objective of the campaign appeared to be the surveillance of dissidents, activists, and traditional espionage targets.</p>
<p>By effectively dismantling the infrastructure and revoking API access, GTIG and its partners have significantly disrupted UNC2814’s operations, safeguarding potential victims from further compromise.</p>


Collections

Google Threat Intelligence Group (GTIG), working with Mandiant, has disrupted a cyber espionage campaign by UNC2814, a China-linked threat actor active since 2017. The group targeted 53 organizations across 42 countries, focusing on telecom providers and government agencies. Their primary tool was GRIDTIDE, a C-based backdoor that used Google Sheets as a covert command-and-control channel, polling spreadsheets for shell commands and exfiltrating PII data while blending in with normal API traffic. GRIDTIDE supported shell execution, file transfers, and AES-128 CBC encryption. GTIG responded by terminating attacker-controlled cloud projects, disabling accounts, sinkholing C2 domains, notifying victims, and releasing IOCs and YARA rules. The campaign's ultimate goal appeared to be surveillance of dissidents, activists, and traditional espionage targets.