GRIDTIDE Backdoor — PRC-Nexus UNC2814 Global Telecom & Government Espionage via Google Sheets C2
GRIDTIDE Backdoor (TL-2026-0168), also tracked as GRIDTIDE Campaign, is a critical-severity advanced persistent threat campaign, first published 2026-03-02. It is attributed to UNC2814 (China) with high confidence, affects Multiple Linux Servers (CentOS, RHEL, Debian-based), maps to 19 MITRE ATT&CK techniques (T1005, T1016, T1021.004), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-0168
- Threat ID
- TL-2026-0168
- Also known as
- GRIDTIDE Campaign, Operation GRIDTIDE
- Severity
- CRITICAL
- Status
- DORMANT
- Category
- APT
- First published
- 2026-03-02
- Last reviewed
- 2026-03-02
- Attribution
- UNC2814
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- telecommunications, government, intelligence, critical-infrastructure
- Target regions
- Africa, Asia, Americas, Europe, Global — 42 confirmed countries
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in GRIDTIDE Backdoor
Malware and tooling: GRIDTIDE
Google Threat Intelligence Group (GTIG) and Mandiant disrupted a global cyber espionage campaign by PRC-nexus threat actor UNC2814. The actor deployed GRIDTIDE, a novel C-based backdoor abusing Google Sheets API as command-and-control infrastructure, compromising 53 victims across 42 countries targeting telecommunications providers and government organizations.
How GRIDTIDE Backdoor works
UNC2814 is a suspected PRC-nexus cyber espionage group tracked by GTIG since 2017 with confirmed intrusions in 42 countries across four continents and suspected targeting in 20+ additional nations. The campaign leverages GRIDTIDE, a sophisticated C-based backdoor that abuses Google Sheets API as a high-availability C2 platform, treating spreadsheet cells as communication channels for command execution, file upload/download, and data exfiltration.
GRIDTIDE's C2 mechanism is cell-based: cell A1 serves as the command polling channel where the backdoor checks for attacker instructions using a <type>-<command_id>-<arg_1>-<arg_2> syntax. Commands include C (execute Base64-encoded bash), U (upload files from spreadsheet to endpoint), and D (download files from endpoint to spreadsheet in 45KB fragments). Cell V1 stores victim system fingerprint data. The malware sanitizes the spreadsheet on execution by clearing 1000 rows using the batchClear API method.
GRIDTIDE uses AES-128-CBC encryption with a 16-byte key stored in a separate file to decrypt Google Drive configuration data containing the service account credentials and spreadsheet ID. All data transfer uses URL-safe Base64 encoding (replacing + and / with - and _) for evasion. The polling mechanism starts at 1-second intervals, backing off to random 5-10 minute intervals after 120 empty polls.
Post-compromise activity includes lateral movement via SSH using service accounts, SoftEther VPN Bridge deployment for encrypted outbound connections (infrastructure dating to July 2018), systemd persistence (/etc/systemd/system/xapt.service), and living-off-the-land reconnaissance. The binary masquerades as 'xapt' (mimicking Debian's apt tool) deployed to /var/tmp/xapt and /usr/sbin/xapt. PII exfiltration targeted telecom subscriber data including names, phone numbers, national IDs, and voter IDs — consistent with surveillance-oriented espionage targeting persons of interest.
Google disrupted the campaign by terminating attacker Cloud Projects, disabling accounts, revoking Sheets API access, and sinkholing infrastructure. UNC2814 has no observed overlap with Salt Typhoon and uses distinct TTPs. Initial access vector was not determined but the actor historically exploits web servers and edge systems.
MITRE ATT&CK techniques used in TL-2026-0168
collection
discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery
lateral-movement
defense-evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
exfiltration
T1030 Data Transfer Size Limits; T1567.002 Exfiltration to Cloud Storage
execution
command-and-control
T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1572 Protocol Tunneling; T1573.001 Symmetric Cryptography
initial-access
T1190 Exploit Public-Facing Application
persistence
credential-access
Affected products and versions in GRIDTIDE Backdoor
- Multiple — Linux Servers (CentOS, RHEL, Debian-based)
Vulnerable versions: All - Google — Google Sheets API (abused, not vulnerable)
Vulnerable versions: N/A — legitimate API abuse
Remediation for GRIDTIDE Backdoor
Immediate actions
- Hunt for GRIDTIDE indicators: /var/tmp/xapt, /usr/sbin/xapt, xapt.service systemd unit
- Monitor for Google Sheets API connections from non-browser processes
- Block known UNC2814 infrastructure IPs and domains
- Audit SSH authorized_keys and service accounts for unauthorized entries
- Review SoftEther VPN Bridge installations on Linux endpoints
Workarounds
- Block outbound HTTPS to sheets.googleapis.com from non-browser processes
- Monitor systemd service creation for suspicious service units
- Disable SoftEther VPN if not operationally required
Longer-term hardening
- Implement application whitelisting to prevent execution from /var/tmp/
- Deploy EDR with behavioral detection for cloud API C2 patterns
- Restrict Google Sheets API access to authorized applications only
- Implement network segmentation for telecom subscriber data systems
- Enable centralized logging with SIEM forwarding for all Linux endpoints
Timeline of GRIDTIDE Backdoor
- GTIG begins tracking UNC2814 as PRC-nexus cyber espionage group targeting telecoms and governments globally.
- VPN configuration metadata indicates UNC2814 leveraging SoftEther VPN infrastructure since July 2018.
- IOCs released by GTIG linked to UNC2814 infrastructure active since at least 2023.
- Mandiant Threat Defense investigation discovers GRIDTIDE backdoor during incident response on CentOS server.
- GTIG investigation confirms 53 victims in 42 countries across four continents, with suspected targeting in 20+ additional nations.
- GTIG publicly releases IOCs linked to UNC2814 infrastructure active since 2023 to help organizations identify activity.
- GTIG publishes detailed technical analysis of GRIDTIDE backdoor and UNC2814 campaign. Source: https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign/
- GTIG, Mandiant, and partners execute coordinated disruption: terminate Cloud Projects, disable accounts, revoke Sheets API access, sinkhole domains.
- SOCRadar and SentinelOne publish threat intelligence coverage referencing GRIDTIDE and UNC2814 campaign.
- ThreadLinqs Intelligence Platform publishes full threat profile TL-2026-0168 with detections and simulations.
- As of 2026-05-29, the GRIDTIDE campaign by PRC-nexus UNC2814 is no longer actively exploited: GTIG/Mandiant disrupted it on 2026-02-25 by terminating attacker Cloud Projects, revoking Sheets API C2 access, sinkholing infrastructure, and releasing IOCs. No CVE is involved (legitimate API abuse) and no post-disruption GRIDTIDE activity or successor is reported, though the long-running actor (tracked since 2017) remains intact and could re-tool.
Sources cited for GRIDTIDE Backdoor
- GTIG/Mandiant: Disrupting the GRIDTIDE Global Cyber Espionage Campaign
- Google Threat Intelligence Group — UNC2814 IOC Release
- Mandiant Threat Defense — GRIDTIDE Detection via Google SecOps
- Google Cloud Shared Fate Security Model
- Google Service Account Authentication Documentation
- SOCRadar Coverage — UNC2814 GRIDTIDE Campaign
- SentinelOne Intelligence Brief — Regional Cyber Threat Landscape
- SOC Prime — CVE-2026-20127 Detection Content
- MITRE ATT&CK — Web Service C2 (T1102)
- Google Sheets API batchClear Documentation
Threats related to GRIDTIDE Backdoor
Detection coverage for TL-2026-0168
As of 2026-03-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0168 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.