UNC2814 GRIDTIDE Backdoor — China-Nexus Telecom & Government Espionage Campaign Exploiting Google Sheets API for C2

UNC2814 GRIDTIDE Backdoor (TL-2026-0195), also tracked as Operation GRIDTIDE, is a critical-severity advanced persistent threat campaign, first published 2026-03-07. It is attributed to UNC2814 (China) with high confidence, affects Telecommunications Providers Telecom Infrastructure (Global), maps to 21 MITRE ATT&CK techniques (T1016, T1021, T1027), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-0195

Threat ID
TL-2026-0195
Also known as
Operation GRIDTIDE, GRIDTIDE Campaign
Severity
CRITICAL
Status
MONITORING
Category
APT
First published
2026-03-07
Last reviewed
2026-03-07
Attribution
UNC2814
Attribution confidence
HIGH
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
telecommunications, government, critical-infrastructure
Target regions
Africa, Asia, Americas, Europe, Middle East
Detection rules
9
Indicators of compromise
24

Malware and tooling in UNC2814 GRIDTIDE Backdoor

Malware and tooling: GRIDTIDE, SoftEther VPN Bridge

China-nexus threat actor UNC2814 (Gallium) conducted a massive espionage campaign breaching 53 telecommunications and government organizations across 42 countries using the GRIDTIDE backdoor, a C-based implant that abuses Google Sheets API for covert command-and-control. Google GTIG disrupted the campaign on February 25, 2026, after confirming suspected operations in over 70 countries total.

How UNC2814 GRIDTIDE Backdoor works

UNC2814 is a suspected People's Republic of China (PRC)-nexus cyber espionage group tracked by Google Threat Intelligence Group (GTIG) since at least 2017. The group has a long history of targeting international governments and global telecommunications organizations across Africa, Asia, and the Americas.

The campaign's centerpiece is GRIDTIDE, a novel C-based backdoor that weaponizes the Google Sheets API as a high-availability command-and-control platform. Rather than using traditional C2 servers, GRIDTIDE treats Google Sheets spreadsheets as bidirectional communication channels, disguising malicious traffic as legitimate Google API calls. The backdoor uses a locally stored 16-byte AES-128 CBC cryptographic key file (xapt.cfg) to decrypt its Google Drive configuration, which contains the threat actor's service account credentials, spreadsheet IDs, and private keys.

GRIDTIDE's C2 protocol operates through a cell-based polling mechanism: cell A1 is monitored every second for attacker commands, cell V1 stores victim fingerprint data (username, endpoint name, OS details, local IP, working directory, language settings, timezone), and cells A2-An facilitate data transfer. The backdoor encodes all communications using URL-safe Base64 and transfers files in 45KB fragments. Upon initialization, GRIDTIDE sanitizes its operational spreadsheet by deleting the first 1,000 rows across columns A-Z using the batchClear method to erase prior activity traces. After 120 consecutive failed command polling attempts, GRIDTIDE implements anti-detection jitter by randomizing polling intervals to 5-10 minutes.

The malware binary is deployed as /var/tmp/xapt, deliberately named to masquerade as the legacy xapt Debian/Ubuntu package management utility. Initial execution uses the command 'nohup ./xapt' to ensure process persistence across session termination. For boot persistence, UNC2814 creates a systemd service at /etc/systemd/system/xapt.service that spawns new instances from /usr/sbin/xapt.

Lateral movement is achieved via SSH using compromised service accounts, supplemented by living-off-the-land binaries for reconnaissance and privilege escalation. UNC2814 also deploys SoftEther VPN Bridge to establish encrypted outbound connections to attacker-controlled infrastructure, with VPN configuration metadata indicating this specific infrastructure has been in use since July 2018.

The campaign's targeting is consistent with telecommunications espionage operations: UNC2814 targets systems containing personally identifiable information (full names, phone numbers, dates and places of birth, voter ID numbers, national ID numbers) to identify, track, and monitor persons of interest. Access to telecom infrastructure enables interception of call data records, SMS messages, and lawful interception systems.

As of February 18, 2026, GTIG confirmed 53 victims across 42 countries with suspected infections in at least 20 additional nations, making this one of the most far-reaching espionage campaigns encountered in recent years. Google's disruption actions included terminating all attacker-controlled Google Cloud Projects, disabling GRIDTIDE C2 infrastructure, revoking Google Sheets API access, sinkholing known domains, and issuing formal victim notifications. The campaign is distinct from the Salt Typhoon campaign, involving separate victims and tradecraft.

---

**Revalidated on 2026-03-12**

No substantive changes required to the current description. All technical details (GRIDTIDE C2 mechanics, xapt binary masquerading, cell-based polling protocol, AES-128 CBC key file, SoftEther VPN bridge, systemd persistence, 45KB file fragmentation, 120-attempt jitter threshold) are fully corroborated by the Google Cloud Blog primary source and independent reporting. One contextual enhancement could be added: noting that UNC2814/Gallium's operational history extends to at least 2012 per Brandefense and ESET tracking (predating the 2017 GTIG tracking start date in the current description), and that this campaign is part of a broader wave of concurrent PRC-nexus telecom espionage operations including UNC3886 (Singapore), UAT-7290 (South Asia), and UAT-9244 (South America). Additionally, the Gallium alias is well-documented by Microsoft (2019), Palo Alto Unit 42 (PingPull, 2022), and ESET (2024) as the same cluster, which the current entry correctly notes.

MITRE ATT&CK techniques used in TL-2026-0195

discovery

T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1087 Account Discovery

lateral-movement

T1021 Remote Services

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

execution

T1059 Command and Scripting Interpreter

command-and-control

T1102 Web Service; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573 Encrypted Channel

collection

T1119 Automated Collection; T1213 Data from Information Repositories

initial-access

T1190 Exploit Public-Facing Application

persistence

T1543 Create or Modify System Process

credential-access

T1552 Unsecured Credentials

impact

T1565 Data Manipulation

Affected products and versions in UNC2814 GRIDTIDE Backdoor

  • Telecommunications Providers — Telecom Infrastructure (Global)
    Vulnerable versions: All — Linux-based systems
  • Government Agencies — Government IT Infrastructure (Global)
    Vulnerable versions: All — Linux-based systems
  • Google — Google Sheets API / Google Cloud
    Vulnerable versions: Abused as C2 channel — not a vulnerability in Google
    Fixed in: Attacker accounts terminated by Google
  • SoftEther — SoftEther VPN Bridge
    Vulnerable versions: Abused for encrypted exfiltration — not a vulnerability in SoftEther

Remediation for UNC2814 GRIDTIDE Backdoor

Immediate actions

  • Block known IOC IP addresses 130.94.6.228 and 38.60.194.21 at network perimeter
  • Block dynamic DNS domains 1cv2f3d5s6a9w.ddnsfree.com and admina.freeddns.org
  • Hunt for xapt binary in /var/tmp/ and /usr/sbin/ on all Linux endpoints
  • Audit systemd services for unauthorized entries at /etc/systemd/system/xapt.service
  • Monitor for anomalous Google Sheets API calls from server infrastructure
  • Review and revoke any unauthorized Google service accounts
  • Check for SoftEther VPN Bridge installations (hamcore.se2, vpn_bridge.config files)

Workarounds

  • Block Google Sheets API access from server-class systems not requiring it
  • Restrict outbound connections to sheets.googleapis.com from production infrastructure
  • Disable systemd service auto-start for non-essential services
  • Implement application allowlisting on critical telecom infrastructure

Longer-term hardening

  • Deploy EDR with behavioral detection for Google Sheets API abuse patterns
  • Implement network segmentation to isolate telecom PII repositories
  • Monitor outbound connections to Google Sheets API from non-browser processes
  • Audit all service accounts with SSH access for unauthorized lateral movement
  • Deploy YARA rules from GTIG for GRIDTIDE binary detection
  • Implement least-privilege API access controls for all cloud service accounts
  • Establish baseline monitoring for systemd service creation events

Weaknesses (CWE) in UNC2814 GRIDTIDE Backdoor

CWE-506, CWE-912

Timeline of UNC2814 GRIDTIDE Backdoor

  • Google GTIG begins tracking UNC2814 as a suspected PRC-nexus cyber espionage group targeting telecoms and governments
  • SoftEther VPN Bridge infrastructure deployed by UNC2814; VPN configuration metadata confirms use since this date
  • Earliest known GRIDTIDE-related indicators of compromise become active; infrastructure deployments confirmed from this period onward
  • UNC2814 escalates GRIDTIDE campaign, expanding targeting across additional countries in Africa, Asia, and the Americas
  • GTIG investigation confirms 53 victims across 42 countries with suspected infections in at least 20 additional nations; disruption operation executed
  • Google releases indicators of compromise through Google Threat Intelligence, CISA coordinates joint advisory with YARA rules, network signatures, and file hashes
  • Google publicly discloses UNC2814 GRIDTIDE campaign and disruption actions; terminates attacker-controlled Google Cloud Projects, revokes API access, sinkhole domains
  • Machine Herald, Breached.company, and additional outlets publish extended technical deep-dives emphasizing the decade-long operational history of UNC2814 dating to 2012-era Gallium operations
  • BleepingComputer and additional security media outlets publish detailed technical coverage of UNC2814 GRIDTIDE campaign
  • Rescana publishes risk assessment report on GRIDTIDE with organizational impact analysis
  • Mandiant publishes detailed technical analysis of UNC2814 GRIDTIDE campaign with comprehensive MITRE ATT&CK mappings and IOCs
  • Revalidation confirms no post-disruption reconstitution observed; GTIG assessment of likely retooling remains standing intelligence gap
  • As of 2026-05-29, the GRIDTIDE campaign remains disrupted since Google GTIG's 2026-02-25 takedown (Cloud Projects terminated, Sheets API revoked, domains sinkholed), with no reconstitution or new variant reported through late May 2026. The China-nexus actor UNC2814/Gallium is not defunct and GTIG expects it to retool, so this stays under MONITORING rather than RESOLVED.

Sources cited for UNC2814 GRIDTIDE Backdoor

Threats related to UNC2814 GRIDTIDE Backdoor

Detection coverage for TL-2026-0195

As of 2026-03-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0195 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats