Google Dismantles UNC2814’s Global Espionage Network Fueled by Google Sheets

A coordinated operation by Google Threat Intelligence Group, Mandiant, and industry partners dismantled UNC2814 (GRIDTIDE), a persistent espionage campaign active since at least 2017 that infiltrated networks across dozens of countries and targeted governments and global telecommunications organizations. The threat actor abused legitimate cloud-hosted services—notably Google Sheets—as a covert C2 mechanism to evade detection; defenders severed attacker-controlled Google Cloud projects, revoked API access, sinkholed domains, and released IOCs and detection signatures to help victims recover.