Google Disrupts ‘Prolific’ and ‘Elusive’ China-Linked Global Hacking Campaign

Google and partners disrupted a prolific UNC2814 cyber-espionage campaign (GridTide) active since 2017 that targeted governments and telecommunications globally; the attackers used a novel backdoor that abused Google Sheets as a covert C2 channel to execute arbitrary shell commands and move files, impacting at least 53 victims across 42 nations, and Google terminated attacker cloud projects and revoked API access to sever persistence.