Uk.Investing

Google Disrupts Chinese-Linked Hacking Group UNC2814 Targeting 53 Organizations

First seen 25 Feb 2026, 13:10 UTC • Uk.Investing

+29 •51.5

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Google has disrupted the operations of a Chinese-linked hacking group known as UNC2814, which had breached at least 53 organizations across 42 countries. The company reported the incident on February 25, 2026, detailing the global impact of the group's activities.

How this analysis works

Timeline

2026-02-25

Google announces disruption of UNC2814 hacking group's operations

Attack Flow

23 entities, 60 inferred relationships (STIX 2.1).

Threat Actor (3)

Gallium
Salt Typhoon
Unc2814

Technique (8)

Data Breach
Malware
T1021.004 - SSH
T1021 - Remote Services
T1041 - Exfiltration Over C2 Channel
T1059.004 - Unix Shell
T1059 - Command and Scripting Interpreter
T1068 - Exploitation for Privilege Escalation

Organization (4)

Google
Debian
Google Cloud Platform
Ubuntu

Malware (2)

Gridtide
Xapt

Affected Platform (1)

Google Workspace

Tool (5)

Google Cloud
Google Sheets
Google Sheets API
Google Spreadsheet
SoftEther VPN Bridge

Relationships

Gallium uses Gridtide
Gallium uses Xapt
Salt Typhoon uses Gridtide
Salt Typhoon uses Xapt
Unc2814 uses Gridtide
Unc2814 uses Xapt
Gallium uses Google Cloud
Gallium uses Google Sheets
Gallium uses Google Sheets API
Gallium uses Google Spreadsheet
Gallium uses SoftEther VPN Bridge
Salt Typhoon uses Google Cloud
Salt Typhoon uses Google Sheets
Salt Typhoon uses Google Sheets API
Salt Typhoon uses Google Spreadsheet
Salt Typhoon uses SoftEther VPN Bridge
Unc2814 uses Google Cloud
Unc2814 uses Google Sheets
Unc2814 uses Google Sheets API
Unc2814 uses Google Spreadsheet
Unc2814 uses SoftEther VPN Bridge
Gallium uses Data Breach
Gallium uses Malware
Gallium uses T1021.004 - SSH
Gallium uses T1021 - Remote Services
Gallium uses T1041 - Exfiltration Over C2 Channel
Salt Typhoon uses Data Breach
Salt Typhoon uses Malware
Salt Typhoon uses T1021.004 - SSH
Salt Typhoon uses T1021 - Remote Services
Salt Typhoon uses T1041 - Exfiltration Over C2 Channel
Unc2814 uses Data Breach
Unc2814 uses Malware
Unc2814 uses T1021.004 - SSH
Unc2814 uses T1021 - Remote Services
Unc2814 uses T1041 - Exfiltration Over C2 Channel
Gallium targets Google
Gallium targets Debian
Gallium targets Google Cloud Platform
Gallium targets Ubuntu
Salt Typhoon targets Google
Salt Typhoon targets Debian
Salt Typhoon targets Google Cloud Platform
Salt Typhoon targets Ubuntu
Unc2814 targets Google
Unc2814 targets Debian
Unc2814 targets Google Cloud Platform
Unc2814 targets Ubuntu
Gridtide targets Google
Gridtide targets Debian
Gridtide targets Google Cloud Platform
Gridtide targets Ubuntu
Xapt targets Google
Xapt targets Debian
Xapt targets Google Cloud Platform
Xapt targets Ubuntu
Gallium related to T1059.004 - Unix Shell
Gallium related to T1059 - Command and Scripting Interpreter
Gallium related to T1068 - Exploitation for Privilege Escalation
Gallium related to Google Workspace

Continue Reading

FamousSparrow APT Expands Targeting to Azerbaijani Energy Sector Exploitation of Remote Services in Cyber Attacks Coruna Spyware Exploited by State Actors in Global Campaigns GrayAlpha Threat Actor Uses MaskBat Loader for NetSupport RAT Deployments Cyber Adversaries Exploit File Enumeration and Data Collection Techniques Coruna iOS Exploit Kit Targets Multiple Threat Actors

Google Disrupts Chinese-Linked Hacking Group UNC2814 Targeting 53 Organizations

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading