TEST

Google Threat Intelligence Group and Mandiant disrupted UNC2814’s global espionage campaign against telecoms and governments, centered on the GRIDTIDE C-based backdoor that hides C2 within legitimate Google Sheets API traffic. The report details initial detection, lateral movement via SSH, persistence with systemd, use of SoftEther VPN, and GRIDTIDE’s command syntax and cell-based polling, along with hunting queries, a YARA rule, and extensive IOCs. GTIG terminated attacker-controlled Google Cloud projects, disabled accounts and infrastructure, sinkholed domains, and notified victims, with 53 confirmed intrusions across 42 countries and broader suspected targeting.