GRIDTIDE Backdoor — UNC2814 PRC-Nexus Global Espionage Campaign Targeting Telecoms & Governments via Google Sheets C2 (53 Victims, 42 Countries)
GRIDTIDE Backdoor (TL-2026-0144), also tracked as GRIDTIDE Campaign, is a critical-severity advanced persistent threat campaign, first published 2026-02-25. It is attributed to UNC2814 (China) with high confidence, affects Google Google Sheets API (abused for C2, not vulnerable), maps to 19 MITRE ATT&CK techniques (T1005, T1016, T1021.004), and is covered by 9 detection rules and 40 indicators of compromise.
Key facts for TL-2026-0144
- Threat ID
- TL-2026-0144
- Also known as
- GRIDTIDE Campaign, UNC2814 Campaign
- Severity
- CRITICAL
- Status
- MONITORING
- Category
- APT
- First published
- 2026-02-25
- Last reviewed
- 2026-02-25
- Attribution
- UNC2814
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- telecommunications, government, critical-infrastructure
- Target regions
- Africa, Asia, Americas, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 40
Malware and tooling in GRIDTIDE Backdoor
Malware and tooling: GRIDTIDE
GRIDTIDE is a novel C-based Linux backdoor deployed by UNC2814, a PRC-nexus espionage group active since 2017. The campaign compromised 53 victims across 42 countries on four continents, targeting telecommunications and government organizations. GRIDTIDE uses Google Sheets API calls as command-and-control, treating spreadsheet cells as a communication channel for commands, file transfers, and data exfiltration. Google/Mandiant disrupted the campaign by terminating attacker Cloud Projects, sinkholing domains, and revoking API access. Distinct from Salt Typhoon — different victims, different TTPs.
How GRIDTIDE Backdoor works
GRIDTIDE is a sophisticated C-based backdoor discovered by Google Threat Intelligence Group (GTIG) and Mandiant during a Mandiant Threat Defense investigation into UNC2814, a suspected People's Republic of China (PRC)-nexus cyber espionage group tracked since 2017. The campaign represents one of the most prolific state-sponsored espionage operations documented, with 53 confirmed victims in 42 countries across four continents, and suspected infections in at least 20 additional countries (70+ total).
GRIDTIDE's defining innovation is its use of Google Sheets API as a command-and-control (C2) platform. Rather than exploiting a vulnerability, the malware abuses legitimate Google Sheets API functionality to disguise C2 traffic as benign SaaS activity. The backdoor expects a 16-byte AES-128-CBC cryptographic key in a separate .cfg file to decrypt its Google Drive configuration containing the service account credentials, private key, and Spreadsheet ID.
The C2 operates on a cell-based polling mechanism: Cell A1 serves as the command channel (malware polls for attacker commands, then overwrites with status responses like S-C-R for Server-Command-Success). Cells A2:An handle data transfer (command output, file uploads, file downloads in 45KB fragments). Cell V1 stores encoded victim metadata (username, hostname, OS, IP, working directory, language, timezone). Commands use a four-part syntax: <type>-<command_id>-<arg_1>-<arg_2>, supporting Command execution (Base64-encoded bash), Upload (cells to file), and Download (file to cells). If no command is pending, GRIDTIDE sleeps 1 second; after 120 polls, it switches to 5-10 minute random sleep intervals.
The infection chain begins with UNC2814 gaining initial access (historically via exploiting web servers and edge systems). The GRIDTIDE payload is delivered in apt.tar.gz from a staging server, deployed as /var/tmp/xapt (masquerading as the Debian apt tool). Persistence is established via systemd service at /etc/systemd/system/xapt.service, with the binary relocated to /usr/sbin/xapt. Post-compromise, SoftEther VPN Bridge is deployed for encrypted outbound tunneling, with VPN metadata suggesting infrastructure reuse since July 2018.
UNC2814's targeting focuses on telecommunications providers globally and government organizations. The campaign specifically targets PII (names, phone numbers, dates of birth, voter IDs, national IDs) consistent with surveillance-oriented espionage — identifying, tracking, and monitoring persons of interest. Historical PRC-nexus telecom intrusions have resulted in theft of call data records, unencrypted SMS, and compromise of lawful intercept systems.
GTIG disrupted the campaign by: (1) terminating all attacker Google Cloud Projects, severing GRIDTIDE C2 access, (2) disabling all known UNC2814 infrastructure and sinkholing domains, (3) disabling attacker accounts and revoking Google Sheets API access, (4) issuing victim notifications, (5) releasing IOCs active since 2023. UNC2814 is distinct from Salt Typhoon — different victims, different TTPs, no observed overlaps.
All data sent and received by GRIDTIDE uses URL-safe Base64 encoding (replacing + and / with - and _) for evasion. The campaign's massive infrastructure includes 26 attacker IPs, 150+ DDNS C2 domains across 18 registrars, and multiple SoftEther VPN servers — reflecting a decade of concentrated operational effort.
MITRE ATT&CK techniques used in TL-2026-0144
collection
discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery
lateral-movement
defense-evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1078 Valid Accounts
exfiltration
T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration to Cloud Storage
execution
command-and-control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1568.002 Domain Generation Algorithms; T1572 Protocol Tunneling
initial-access
T1190 Exploit Public-Facing Application
persistence
credential-access
Affected products and versions in GRIDTIDE Backdoor
- Google — Google Sheets API (abused for C2, not vulnerable)
- Multiple — Telecommunications providers (53 victims, 42 countries)
- Multiple — Government organizations (targeted alongside telecoms)
Remediation for GRIDTIDE Backdoor
Immediate actions
- Hunt for GRIDTIDE IOCs: /var/tmp/xapt, /usr/sbin/xapt, xapt.cfg, xapt.service
- Block all 26 attacker IPs at perimeter (see IOC list)
- Block all 150+ DDNS C2 domains at DNS/proxy level
- Search for non-browser processes connecting to sheets.googleapis.com (batchClear, batchUpdate, valueRenderOption)
- Check for systemd services named xapt.service or pmp.service
- Hunt for SoftEther VPN Bridge components: hamcore.se2, vpn_bridge.config
- Deploy YARA rule G_APT_Backdoor_GRIDTIDE_1 across Linux fleet
- Audit /var/tmp/ and /usr/sbin/ for suspicious binaries with short alphanumeric names
Workarounds
- Block DDNS registrars commonly abused by UNC2814 at DNS resolver level
- Restrict outbound Google Sheets API access to authorized applications only
- Monitor for .cfg files in proximity to suspicious ELF binaries
Longer-term hardening
- Monitor all Google Sheets API access from non-browser processes
- Implement allowlisting for Google API service account authentication from servers
- Deploy Google SecOps Mandiant Hunting rule pack for GRIDTIDE detection
- Block DDNS provider domains at organizational DNS (ddnsfree.com, freeddns.org, kozow.com, etc.)
- Segment telecom infrastructure from general networks
- Monitor for SoftEther VPN Bridge deployment on critical infrastructure
Weaknesses (CWE) in GRIDTIDE Backdoor
CWE-506, CWE-912
Timeline of GRIDTIDE Backdoor
- GTIG begins tracking UNC2814 as a suspected PRC-nexus cyber espionage group targeting international governments and telecommunications.
- SoftEther VPN Bridge configuration metadata indicates UNC2814 has been leveraging specific infrastructure since at least July 2018.
- IOCs released by GTIG linked to UNC2814 infrastructure have been active since at least 2023.
- GTIG investigation confirms 53 victims in 42 countries with suspected infections in 20+ additional countries (70+ total).
- Google SecOps releases detection signatures and hunting queries for GRIDTIDE including YARA rule G_APT_Backdoor_GRIDTIDE_1.
- GTIG/Mandiant publishes full technical analysis of GRIDTIDE backdoor and UNC2814 campaign. IOCs released publicly. Source: https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign/
- GTIG, Mandiant, and partners execute coordinated disruption: terminated attacker Cloud Projects, disabled infrastructure, sinkholed domains, revoked API access, issued victim notifications.
- As of 2026-05-29, the GRIDTIDE/UNC2814 campaign remains disrupted since Google/Mandiant's 2026-02-25 takedown (terminated Cloud Projects, sinkholed domains, revoked Sheets API C2), with no confirmed new activity through May. GTIG assesses this PRC-nexus actor (active since 2017) will work to re-establish its footprint, so monitoring is warranted; no CVE applies as this abused legitimate API functionality.
Sources cited for GRIDTIDE Backdoor
Threats related to GRIDTIDE Backdoor
- GRIDTIDE Backdoor — PRC-Nexus UNC2814 Global Telecom & Government Espionage via Google Sheets C2
- UNC2814 GRIDTIDE Backdoor — China-Nexus Telecom & Government Espionage Campaign Exploiting Google Sheets API for C2
- UAT-8302 China-Nexus APT Campaign — NetDraft, CloudSorcerer v3, VSHELL/SNOWLIGHT, SNOWRUST, SNAPPYBEE/DeedRAT, ZingDoor, and Draculoader Targeting Government Entities in South America and Southeastern Europe
Detection coverage for TL-2026-0144
As of 2026-02-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0144 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.