Google Stops Chinese-Linked Hackers Targeting 53 Global Groups

• The hacking group had a nearly decade-long history and accessed sensitive data including full names, phone numbers, national ID numbers, and used telcos' lawful intercept capabilities to monitor SMS messages and call records
• Hackers exploited Google Sheets to blend into normal network traffic and evade detection, though this was not a compromise of any Google product
• This campaign is separate from the 'Salt Typhoon' operation that targeted hundreds of U.S. organizations and prominent political figures; China denied the allegations and rejected attempts to use cybersecurity issues to 'smear or slander' the country

Summary

Key Development: Google has disrupted operations of UNC2814 (also known as "Gallium"), a Chinese-linked hacking group that breached at least 53 organizations across 42 countries. The group has conducted surveillance operations for nearly a decade, primarily targeting government organizations and telecommunications companies.

Operational Details: The hackers utilized Google Sheets to evade detection and blend into normal network traffic, though Google emphasized this was not a product compromise. Google, along with unnamed partners, terminated Google Cloud projects controlled by the group, disabled their internet infrastructure, and shut down accounts used to access Google Sheets. At the time of disruption, the group potentially had access to entities in at least 22 additional countries.

Data Compromised: In one confirmed case, hackers installed a backdoor called "GRIDTIDE" on systems containing sensitive personal information including full names, phone numbers, birth dates, voter IDs, and national ID numbers. Similar campaigns have been used to steal call data records, monitor SMS messages, and exploit lawful intercept capabilities at telecommunications providers.

Official Response: John Hultquist, chief analyst with Google Threat Intelligence Group, described it as "a vast surveillance apparatus used to spy on people and organizations throughout the world." The Chinese Embassy denied the allegations, stating China "consistently opposes and combats hacking activities" and rejects attempts to "smear or slander China."

Context: Google clarified this activity is separate from the "Salt Typhoon" campaign, another high-profile Chinese hacking operation that U.S. authorities confirmed targeted hundreds of U.S. organizations and prominent political figures.