UNC2814

UNC2814 is a suspected People’s Republic of China (PRC)-nexus cyber espionage group that Google Threat Intelligence Group (GTIG) has tracked since 2017. The group has historically targeted international governments and global telecommunications organizations across Africa, Asia, and the Americas. GTIG disclosed and disrupted a global UNC2814 espionage campaign that impacted 53 victims in 42 countries across four continents, with suspected infections in at least 20 additional countries. Reporting states the group has no observed overlap with activity publicly reported as Salt Typhoon. UNC2814 is associated with a novel C-based backdoor named GRIDTIDE. GRIDTIDE abused legitimate Google Sheets API functionality for command-and-control, allowing malicious traffic to blend in with normal cloud API activity rather than exploiting a vulnerability in Google products. The malware is capable of executing arbitrary shell commands and uploading and downloading files. Reported tradecraft in victim environments included use of a service account for SSH-based lateral movement, living-off-the-land binaries for reconnaissance, privilege escalation, and persistence, creation of a malicious systemd service for persistence, and deployment of SoftEther VPN Bridge to establish outbound encrypted connectivity. UNC2814 was also reported to target systems containing personally identifiable information, which GTIG assessed as consistent with telecommunications espionage used to identify, track, and monitor persons of interest. Separate reporting states UNC2814 used persona-driven jailbreaking against AI systems for vulnerability research, including prompts such as “senior security auditor,” “network security expert specializing in embedded devices,” and “senior C/C++ binary security expert.” These prompts were used to push past model safety guardrails while researching TP-Link firmware, remote code execution flaws, and Odette File Transfer Protocol (OFTP) implementations. One source cited in the content states UNC2814 is also known as Gallium.