Disrupting the GRIDTIDE Global Cyber Espionage Campaign

A global espionage campaign targeting telecommunications and government organizations across four continents has been disrupted. The threat actor, UNC2814, is suspected to be linked to China and has been active since 2017. The campaign utilized a sophisticated backdoor called GRIDTIDE, which leveraged Google Sheets API for command and control. The attackers compromised 53 victims in 42 countries, with suspected infections in 20 more. GRIDTIDE's capabilities include executing shell commands, file transfers, and evading detection by disguising traffic as legitimate cloud API requests. The disruption involved terminating attacker-controlled cloud projects, disabling infrastructure, and revoking API access.

• ValleyRAT is spreading disguised as adwareMalware2026-08-31
• Targeted Attack on Government Entities in the Middle East | Part 1Malware2026-07-21
• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16
• NeedyMantis: Unpacking a post-compromise malware family used in targeted operationsMalware2026-09-28
• Angry Birds: Toy Ghouls’ new toysMalware2026-09-04