Acronis Cyberthreats Update, March 2026

**Executive summary:** In February 2026 Google Threat Intelligence Group, Mandiant and partners disclosed disruption of a China-linked APT (UNC2814) active since at least 2023 that deployed a C-based backdoor called GRIDTIDE abusing the Google Sheets API for covert command-and-control across telecommunications providers and government networks (affected: 53 organizations in 42 countries); response steps included terminating attacker-controlled Google Cloud projects, revoking API access, sinkholing domains and notifying affected organizations. The document also reports Acronis' February 2026 endpoint malware detection statistics and provides recommended protections.