🌍 Google Disrupts Chinese Hacker Campaign That Breached 53 Telecom and Government Networks

Google and its cybersecurity partners have disrupted a large-scale cyber espionage campaign linked to a Chinese state-aligned hacking group that infiltrated at least 53 telecommunications and government organizations across 42 countries.

The operation targeted critical infrastructure worldwide and was attributed to a threat group tracked as UNC2814, which has been active since at least 2017.

The campaign focused heavily on telecommunications providers and government institutions, giving attackers access to sensitive communications, personal records, and national infrastructure systems.

Security researchers believe the true scope may be even larger, with suspected infections detected in at least 20 additional countries.

🕵️ A Global Espionage Operation

The investigation was led by the Google Threat Intelligence Group (GTIG) in collaboration with Mandiant and multiple industry partners.

Researchers confirmed that UNC2814 conducted a widespread espionage campaign across four continents, targeting:

• Government agencies

• National telecommunications providers

• Organizations holding large volumes of citizen data

Telecom providers are particularly attractive targets for nation-state actors because they can provide access to:

• call records

• SMS messages

• subscriber identity information

• lawful interception systems

Such access allows attackers to monitor political targets, track individuals, and gather intelligence over extended periods.

🧬 The GRIDTIDE Backdoor

During the investigation, analysts discovered a previously unknown malware implant called GRIDTIDE.

This backdoor is written in C and is designed for stealthy long-term espionage operations.

What makes GRIDTIDE especially unusual is how it communicates with its command-and-control infrastructure.

Instead of using traditional servers, the malware uses Google Sheets as its command channel.

☁️ Hiding in Plain Sight

GRIDTIDE abuses legitimate Google Sheets API requests to send and receive commands.

This approach allows malicious traffic to blend into normal cloud activity.

The malware communicates by:

• polling spreadsheet cells for commands

• executing shell instructions

• writing results back into the spreadsheet

It can also:

• upload files

• download additional payloads

• exfiltrate data in small fragments

Because these actions occur through legitimate Google API calls, traditional security monitoring tools may not flag them as suspicious.

🔐 Encryption and Configuration

GRIDTIDE stores a 16-byte cryptographic key on infected systems.

This key decrypts configuration data containing:

• Google service account credentials

• spreadsheet identifiers

• private authentication keys

Once decrypted, the malware can communicate directly with attacker-controlled Google Sheets documents.

To further evade detection, the malware uses a modified encoding scheme that replaces standard Base64 characters with alternate symbols.

⚙️ Initial Compromise and Lateral Movement

The campaign typically begins with attackers exploiting vulnerable internet-facing servers or edge devices.

Researchers observed a malicious binary named xapt running with root privileges on compromised Linux servers.

This binary performs reconnaissance and prepares systems for persistence.

Attackers then:

• establish persistence through systemd services

• deploy GRIDTIDE backdoors

• move laterally using SSH and service accounts

To maintain encrypted outbound communication, the attackers deployed SoftEther VPN Bridge, allowing traffic to exit compromised networks securely.

📂 Targeting Sensitive Data

Once inside telecom and government networks, attackers focused on systems storing personally identifiable information (PII).

Compromised data included:

• full names

• phone numbers

• birth dates

• national identification numbers

Such information is often used for intelligence tracking and surveillance.

Historically, similar campaigns against telecom providers have also enabled attackers to access:

• call detail records

• SMS communications

• lawful intercept infrastructure

These capabilities allow long-term monitoring of political targets, activists, and government officials.

🛑 Google’s Disruption Effort

To stop the campaign, Google and its partners launched a coordinated takedown of the group’s infrastructure.

Key actions included:

🔧 Terminating attacker-controlled Google Cloud projects

🌐 Sinkholing known domains linked to the operation

🔑 Revoking access to Google Sheets API keys used by the malware

👤 Disabling attacker-controlled accounts

These actions effectively disrupted the command-and-control infrastructure used by the GRIDTIDE malware.

📡 Detection Guidance Released

Security researchers also released a set of detection signatures tied to UNC2814 infrastructure active since 2023.

Affected organizations have been notified directly and provided assistance with remediation.

However, analysts warn that the threat group will likely attempt to rebuild its infrastructure using new cloud services and updated tools.

🎯 Security Takeaway

This campaign demonstrates a growing trend in cyber espionage operations:

Attackers increasingly hide their activity inside trusted cloud platforms.

By leveraging legitimate services such as Google APIs, malicious activity can blend into everyday network traffic.

This makes detection significantly harder.

Organizations must monitor not only suspicious domains but also abnormal usage patterns of trusted cloud services.

Because in modern cyber warfare, attackers don’t always hide in the dark.

Sometimes they hide in plain sight inside the cloud.