🇨🇳cnBeta (Full RSS)•Feb 25, 2026Stalecollected in 8m

Google Stops China-Linked Hackers Hitting 53 Orgs

Post LinkedIn

🇨🇳Read original on cnBeta (Full RSS)

#cybersecurity #state-sponsored #threat-intelgoogle-threat-intelligencegoogle unc2814 gallium

💡China-linked hacks hit 53 orgs globally—key intel for securing AI infra

⚡ 30-Second TL;DR

What Changed

Google thwarted UNC2814/Gallium hacking campaign

Why It Matters

Reveals persistent state-sponsored cyber risks to critical infrastructure, prompting enterprises to bolster defenses amid rising geopolitical tensions.

What To Do Next

Subscribe to Google Cloud's Mandiant threat reports for latest actor IOCs.

Who should care:Enterprise & Security Teams

Key Points

•Google thwarted UNC2814/Gallium hacking campaign
•Targets: 53 institutions in 42 countries, mainly gov and telecom
•Group active for nearly 10 years, China-linked
•Google's security measures successfully disrupted attacks

🧠 Deep Insight

Background and context from public sources — not the original article. 5 sources cited.

🔑 Enhanced Key Takeaways

•Hackers used Google Sheets to coordinate targeting and steal data, blending into normal network traffic without compromising any Google products.[1][2]
•Group installed GRIDTIDE backdoor on a system holding sensitive data like full names, phone numbers, birth details, voter IDs, and national ID numbers.[1][3]
•Confirmed access to 53 entities plus potential targeting in at least 22 additional countries at disruption time.[2][5]
•Activities aimed at identifying/tracking individuals, including exfiltrating call records, monitoring SMS, and exploiting telecom lawful intercept systems.[2][5]

🛠️ Technical Deep Dive

•UNC2814/Gallium employed Google Sheets for command-and-control and data exfiltration, leveraging legitimate services to evade detection by mimicking routine traffic.[1][2]
•Installed GRIDTIDE backdoor provided persistent access to systems with personal identifiable information (PII).[1][3]
•Disruption involved terminating hacker-controlled Google Cloud projects, disabling associated internet infrastructure, and deactivating fake accounts.[1][2]

🔮 Future ImplicationsAI analysis grounded in cited sources

Google's disruption will temporarily hinder UNC2814 operations but prompt rapid infrastructure rebuilding.

Past state-linked groups like Gallium have demonstrated resilience by quickly re-establishing C2 after takedowns, as per Google's Threat Intelligence observations.[2]

Increased scrutiny on cloud service abuse will lead to enhanced detection tools across providers.

Use of Google Sheets highlights a common tactic, spurring industry-wide improvements in anomalous traffic monitoring without product vulnerabilities.[1][5]

Telecom and government sectors face heightened espionage risks from similar campaigns.

GRIDTIDE and surveillance patterns align with ongoing efforts to exploit lawful intercept and SMS monitoring, distinct from Salt Typhoon but indicative of persistent threats.[5]