Google Disrupts UNC2814 Espionage Campaign Using GRIDTIDE Backdoor via Google Sheets API

Google Threat Intelligence Group (GTIG), Mandiant, and industry partners reported disrupting infrastructure used by suspected China-nexus cyber-espionage actor UNC2814, assessed to have breached at least 53 organizations across 42 countries, with additional suspected infections in 20+ more countries. The activity primarily targeted government and telecommunications networks across Africa, Asia, and the Americas, and used SaaS API calls to blend command-and-control (C2) traffic into legitimate cloud application activity; the initial access vector remains under investigation, though the actor has a history of exploiting web servers and edge systems.

The disrupted campaign featured a new C-based backdoor, GRIDTIDE, which abuses the Google Sheets API as an evasive C2 channel to exchange commands and data. Reported capabilities include arbitrary shell command execution and file upload/download; the malware authenticates using a Google service account (including a hardcoded private key), uses spreadsheet cells (e.g., A1 for command/status and A2:An for output/exfiltration), and implements polling logic that shifts to less frequent randomized checks to reduce noise. Post-compromise tradecraft included lateral movement via SSH using a service account, living-off-the-land activity for recon/privilege escalation/persistence, persistence via a systemd service at /etc/systemd/system/xapt.service launching /usr/sbin/xapt, and use of SoftEther VPN Bridge to establish encrypted outbound connectivity.