GRIDTIDE Backdoor — UNC2814 PRC-Nexus Global Espionage Campaign Targeting Telecoms & Governments via Google Sheets C2 (53 Victims, 42 Countries) — Threadlinqs Intelligence
As of 2026-05-30, GRIDTIDE Backdoor — UNC2814 PRC-Nexus Global Espionage Campaign Targeting Telecoms & Governments via Google Sheets C2 (53 Victims, 42 Countries) is a critical-severity apt threat attributed to UNC2814 (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 40 indicators of compromise.
Threat ID: TL-2026-0144 · Severity: CRITICAL · Status: MONITORING · Category: APT
Attribution: UNC2814 · China · ESPIONAGE
GRIDTIDE is a novel C-based Linux backdoor deployed by UNC2814, a PRC-nexus espionage group active since 2017. The campaign compromised 53 victims across 42 countries on four continents, targeting
GRIDTIDE is a sophisticated C-based backdoor discovered by Google Threat Intelligence Group (GTIG) and Mandiant during a Mandiant Threat Defense investigation into UNC2814, a suspected People's Republic of China (PRC)-nexus cyber espionage group tracked since 2017. The campaign represents one of the most prolific state-sponsored espionage operations documented, with 53 confirmed victims in 42 countries across four continents, and suspected infections in at least 20 additional countries (70+ total).
GRIDTIDE's defining innovation is its use of Google Sheets API as a command-and-control (C2) platform. Rather than exploiting a vulnerability, the malware abuses legitimate Google Sheets API functionality to disguise C2 traffic as benign SaaS activity. The backdoor expects a 16-byte AES-128-CBC cryptographic key in a separate .cfg file to decrypt its Google Drive configuration containing the service account credentials, private key, and Spreadsheet ID.
The C2 operates on a cell-based polling mechanism: Cell A1 serves as the command channel (malware polls for attacker commands, then overwrites with status responses like S-C-R for Server-Command-Success). Cells A2:An handle data transfer (command output, file uploads, file downloads in 45KB fragments). Cell V1 stores encoded victim metadata (username, hostname, OS, IP, working directory, language, timezone). Commands use a four-part syntax: <type>-<command_id>-<arg_1>-<arg_2>, supporting Command execution (Base64-encoded bash), Upload (cells to file), and Download (file to cells). If no command is pending, GRIDTIDE sleeps 1 second; after 120 polls, it switches to 5-10 minute random sleep intervals.
The infection chain begins with UNC2814 gaining initial access (historically via exploiting web servers and edge systems). The GRIDTIDE payload is delivered in apt.tar.gz from a staging server, deployed as /var/tmp/xapt (masquerading as the Debian apt tool). Persistence is established via systemd service at /etc/systemd/system/xapt.service, with the binary relocated to /usr/sbin/xapt. Post-compromise, SoftEther VPN Bridge is deployed for encrypted outbound tunneling, with VPN metadata suggesting infrastructure reuse since July 2018.
UNC2814's targeting focuses on telecommunications providers globally and government organizations. The campaign specifically targets PII (names, phone numbers, dates of birth, voter IDs, national IDs) consistent with surveillance-oriented espionage — identifying, tracking, and monitoring persons of interest. Historical PRC-nexus telecom intrusions have resulted in theft of call data records, unencrypted SMS, and compromise of lawful intercept systems.
GTIG disrupted the campaign by: (1) terminating all attacker Google Cloud Projects, severing GRIDTIDE C2 access, (2) disabling all known UNC2814 infrastructure and sinkholing domains, (3) disabling attacker accounts and revoking Google Sheets API access, (4) issuing victim notifications, (5) releasing IOCs active since 2023. UNC2814 is distinct from Salt Typhoon — different victims, different TTPs, no observed overlaps.
All data sent and received by GRIDTIDE uses URL-safe Base64 encoding (replacing + and / with - and _) for evasion. The campaign's massive infrastructure includes 26 attacker IPs, 150+ DDNS C2 domains across 18 registrars, and multiple SoftEther VPN servers — reflecting a decade of concentrated operational effort.
Weaknesses (CWE)
CWE-506, CWE-912
Target sectors: telecommunications, government, critical-infrastructure
Target regions: Africa, Asia, Americas, Europe, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 40 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, CRITICAL, threat intelligence, cybersecurity, T1190, T1059.004, T1543.002, T1078, T1078, T1036.005, T1027, T1102.002, T1552.001, T1082