Google GTIG disrupted China-linked APT UNC2814 halting attacks on 53 orgs in 42 countries

Google GTIG, Mandiant, and partners disrupted UNC2814, a suspected China-linked APT that used a GRIDTIDE C-based backdoor which leverages Google Sheets API as covert C2 to target telecommunications and government organizations worldwide; the report details host reconnaissance, privilege escalation, lateral movement, persistence mechanisms, use of living-off-the-land binaries, and remediation actions including termination of attacker-controlled Google Cloud projects and publication of IOCs.