GTIG And Mandiant Disrupt Global Espionage Campaign

Video | Business Headlines | Internet | Science | Scientific Ethics | Technology |

Google Threat Intelligence Group (GTIG) and Mandiant have published new research highlighting how, in coordination with industry partners, they disrupted the infrastructure of UNC2814, a suspected PRC-nexus espionage group. GTIG confirmed 53 intrusions by UNC2814 in 42 nations globally, and identified suspected targeting in more than 20 other nations.

While recent headlines have focused on other actors targeting telecoms and government organizations, it is important to note that GTIG has seen no overlaps between UNC2814 and “Salt Typhoon.” GTIG has tracked UNC2814 for nearly a decade and views it as a distinct group, targeting a different set of global victims, using unique tactics and infrastructure.

GTIG’s understanding of UNC2814’s campaign was accelerated by a Mandiant investigation that identified the group deploying a novel backdoor in late 2025, dubbed “GRIDTIDE,” to maintain persistence.

The GRIDTIDE sample GTIG analyzed connects to a threat actor-controlled Google Spreadsheet for command and control (C2), effectively allowing it to blend in with normal network traffic.

This is not the result of a security vulnerability or exploit in Google Sheets.

Rather, it is an example of threat actors abusing legitimate Google Sheets functionality to evade detection. This is part of an ongoing trend of actors increasingly finding success in abusing SaaS platforms as an alternative to creating and maintaining their own custom infrastructure.

Targeting: UNC2814 primarily targeted global telecommunications providers and government organizations. While we have only limited visibility into the data stolen in this campaign we expect the intrusions are designed to identify, track, and monitor the communications of persons of interest by compromising data like PII, call logs, and text message traffic. In multiple confirmed compromises, the group targeted highly sensitive PII, including National and Voter ID numbers.

The Scale: To date, GTIG has identified 53 victims currently impacted by UNC2814 in 42 countries . We have also identified evidence of targeting in more than 20 other countries.

UNC2814 has been active and building out their global footprint since at least 2017 and we believe the disruption will be a significant setback for their prolific operations.

This is one of the most far reaching, impactful campaigns GTIG has encountered in recent years.

GTIG has issued formal victim notifications to each of these targets and is actively supporting organizations with verified compromises resulting from this threat.

Infrastructure Takedown: In a coordinated action, Google terminated all attacker-controlled Cloud Projects, disabled known accounts, and sinkholed current/historical domains to sever access to compromised environments. We expect this disruption to setback a decade of effort by UNC2814 to build out their significant global footprint.

Novel Backdoor: GRIDTIDE is a C-based malware that turns legitimate cloud spreadsheets into command-and-control (C2) infrastructure to facilitate the transfer of raw data from victims

While the GRIDTIDE sample from this specific campaign leveraged Google Sheets for its C2, GTIG notes its architecture is adaptable and the actor “could easily make use of other cloud-based spreadsheet tools in the same manner.”

Based on the sample analyzed, the earliest known deployment of this backdoor is late 2025, but GTIG anticipates new details historic compromises will emerge as organizations begin hunting for this using the newly published IOCs and hunting signals.

The airline experienced a slower than expected recovery in domestic demand however international performance was supported by continued strong offshore bookings, particularly in the premium cabins.

Brewers Association of New Zealand Executive Director Dylan Firth said the data reinforces a clear and consistent message: New Zealanders are drinking less, and drinking more moderately.

The survey asked the state of 10 environmental domains. New Zealanders think that our air and protected natural areas are in a better state than the other environmental domains.

The worker’s hand was pulled into machine rollers at French Bakery in Christchurch in April 2023. His index finger was amputated, thumb partially amputated, and middle finger crushed.

EPA Acting Manager of New Organisms and International Applications, Peter Day, says the leaf-feeding beetle offers a low-maintenance solution that can reach areas that are hard to access.

The key take-away from our regional stock-take is that there are a few early signs of this convergence occurring, but it’s yet to happen to any significant degree.

Business Business.scoop The Main Report - Trends In NZ Business Finance NZ & AUS Shares Oil Futures Spot Gold Science Weather Underground Te Papa's Blog

Finance NZ & AUS Shares Oil Futures Spot Gold Science Weather Underground Te Papa's Blog

Science Weather Underground Te Papa's Blog

Get started today with a free trial