Loading story…
Google disclosed action against GRIDTIDE, a global cyber espionage campaign tracked by Mandiant, saying it disrupted infrastructure tied to the operation and published new threat intelligence on the actor’s activity. The campaign was described as an espionage effort with international reach, and Google said the disruption was intended to hinder the group’s ability to conduct ongoing intrusions and intelligence collection.
The disclosure came through a Google Cloud threat intelligence report by Mandiant that framed GRIDTIDE as a coordinated spying operation rather than financially motivated cybercrime. While the public notice focused on the disruption and attribution effort, it also signaled that defenders should review the newly released intelligence for indicators, targeting patterns, and tradecraft associated with GRIDTIDE to identify possible exposure and strengthen detection coverage.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Google Cloud published a threat intelligence blog post describing efforts to disrupt the GRIDTIDE global cyber espionage campaign. The provided references do not include additional incident details beyond the publication itself.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 227 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cloud.google.com
Open sourcecloud.google.com
Open sourcedocs.cloud.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group (**GTIG**), *Mandiant*, and industry partners reported disrupting infrastructure used by suspected China-nexus cyber-espionage actor **UNC2814**, assessed to have breached **at least 53 organizations across 42 countries**, with additional suspected infections in **20+** more countries. The activity primarily targeted **government** and **telecommunications** networks across Africa, Asia, and the Americas, and used **SaaS API calls** to blend command-and-control (C2) traffic into legitimate cloud application activity; the initial access vector remains under investigation, though the actor has a history of exploiting **web servers and edge systems**. The disrupted campaign featured a new C-based backdoor, **GRIDTIDE**, which abuses the **Google Sheets API** as an evasive C2 channel to exchange commands and data. Reported capabilities include arbitrary shell command execution and file upload/download; the malware authenticates using a Google service account (including a hardcoded private key), uses spreadsheet cells (e.g., `A1` for command/status and `A2:An` for output/exfiltration), and implements polling logic that shifts to less frequent randomized checks to reduce noise. Post-compromise tradecraft included lateral movement via **SSH** using a service account, **living-off-the-land** activity for recon/privilege escalation/persistence, persistence via a systemd service at `/etc/systemd/system/xapt.service` launching `/usr/sbin/xapt`, and use of **SoftEther VPN Bridge** to establish encrypted outbound connectivity.
Jun 29, 2026
Google’s **Threat Intelligence Group (GTIG)** and industry partners took coordinated legal and technical action to disrupt **IPIDEA**, described as one of the world’s largest *residential proxy* networks used to mask malicious activity behind legitimate household and small-business IP addresses. Google reported pursuing court action to seize/take down domains used to command infected devices and manage proxy traffic, while also sharing intelligence about **IPIDEA software development kits (SDKs)** with platform providers, law enforcement, and researchers to enable broader enforcement. Google said the operation **significantly degraded** IPIDEA by reducing the available pool of proxy devices by **millions**, with impact likely extending to affiliated/resold proxy services that share infrastructure. On Android, Google expanded protections via **Google Play Protect**, including alerting users, removing apps known to include IPIDEA SDKs, and blocking future installation attempts on certified devices. Reporting linked IPIDEA SDKs to enrollment of devices into multiple botnets (including **BadBox 2.0**, **Aisuru**, and **Kimwolf**) and noted GTIG observed **550+ threat groups** using IPIDEA exit nodes over a seven-day period in January 2026; affected devices reportedly spanned smartphones, Windows PCs, and other consumer hardware, with US/Canada/Europe residential IPs particularly sought after.
Jun 29, 2026
Google Threat Intelligence Group (GTIG) reported that the **defense industrial base (DIB)** is under sustained, multi-vector pressure from state-backed and aligned actors seeking to steal sensitive military technology, disrupt supply chains, and undermine national security. The report highlights Russian-linked activity focused on **unmanned aircraft systems (UAS)** and other emerging technologies, including **TEMP.Vermin** using drone-themed lures to deliver malware and **APT44 (Sandworm/GRU)** targeting military personnel devices with tooling such as **INFAMOUSCHISEL** to harvest data from battlefield-related applications; it also notes some Russian operators are using **LLMs** to improve reconnaissance and social-engineering effectiveness. GTIG also describes North Korea’s continued use of **IT-worker/insider** placement to generate revenue and access within Western organizations. Separately, reporting on **Transparent Tribe (APT36)** describes ongoing espionage campaigns against Indian government and defense targets across Windows and Linux, including spear-phishing that deploys **Geta RAT** and execution chains abusing legitimate Windows components (e.g., `mshta.exe`) and **XAML deserialization** for evasion, alongside a shift toward more mature Linux tooling and persistence. A third report (Picus Labs’ *Red Report*) is broader trend research rather than a specific incident, claiming ransomware encryption is declining while “**sleeperware**”/dormant extortion tradecraft is rising based on ATT&CK technique prevalence across large-scale simulation and telemetry; it does not materially add to the defense-sector espionage narrative beyond general attacker TTP trends.
Jun 29, 2026