Google Disrupts GRIDTIDE Global Cyber Espionage Campaign
Threat Actor Intelligence · 3 sources · Updated 4mo ago · First seen May 25, 2026
Google disclosed action against GRIDTIDE, a global cyber espionage campaign tracked by Mandiant, saying it disrupted infrastructure tied to the operation and published new threat intelligence on the actor’s activity. The campaign was described as an espionage effort with international reach, and Google said the disruption was intended to hinder the group’s ability to conduct ongoing intrusions and intelligence collection.
The disclosure came through a Google Cloud threat intelligence report by Mandiant that framed GRIDTIDE as a coordinated spying operation rather than financially motivated cybercrime. While the public notice focused on the disruption and attribution effort, it also signaled that defenders should review the newly released intelligence for indicators, targeting patterns, and tradecraft associated with GRIDTIDE to identify possible exposure and strengthen detection coverage.
