Google Disrupts UNC2814 GRIDTIDE Campaign After 53 Breaches Across 42 Countries

Google and industry partners disrupted a long-running cyber espionage campaign attributed to UNC2814 that breached at least 53 organizations across 42 countries (with suspected activity in over 70 countries). The actor deployed a novel C-based backdoor called GRIDTIDE that uses the Google Sheets API as a covert C2 channel to deliver commands, transfer files, and exfiltrate data; operators also used service accounts for lateral movement, SoftEther VPN for encrypted outbound connections, living-off-the-land binaries, and systemd persistence. Google terminated attacker-controlled Google Cloud projects, disabled known infrastructure, issued victim notifications, and continues to support affected organizations.