GOOGLE CATCHES BEIJING SPIES USING SHEETS TO SPREAD ESPIONAGE ACROSS 4 CONTINENTS

Summary from the TLDR InfoSec newsletter

Google Threat Intelligence disrupted UNC2814, a China-linked espionage group that compromised 53 victims across 42 countries by targeting telecoms and government organizations with a novel backdoor called Gridtide that abuses Google Sheets API for C2 communication. The group, tracked since 2017, escalated privileges via SSH lateral movement and deployed SoftEther VPN Bridge for persistent encrypted connections, with infrastructure dating back to July 2018. Google terminated all attacker-controlled Cloud Projects, disabled known infrastructure, and revoked the Sheets API access used for C2 operations.