Espionage campaign against government and telecom disrupted in 42 countries

Google Threat Intelligence Group and Mandiant led a coordinated operation to disrupt a global cyber espionage campaign. Behind it is UNC2814, a suspected PRC-nexus threat actor targeting government and telecommunications organisations worldwide. The attackers used a novel backdoor named GRIDTIDE, which uses Google Sheets as its command-and-control channel to keep access stealthy. As of 18 February, investigations confirmed 53 victim organisations across 42 countries on four continents, with suspected infections in at least 20 further nations.

What this means for your organisation

The use of ordinary cloud services as a command channel is the key point. The traffic goes to a service the organisation already trusts and uses daily, so it does not stand out in firewall logs. Telecoms and the public sector are the stated targets, but subcontractors into those sectors are a well-worn route in. Norwegian organisations in or adjacent to critical infrastructure should count themselves as relevant, not as bystanders.

Berigo recommends

• Map which cloud services are permitted from servers and operational environments, and remove those with no business case there.
• Build detection on unusual usage patterns against approved cloud services, not only on which domains are visited.
• Review the access held by suppliers and subcontractors that reaches into critical systems.
• Make sure your NIS2 work covers the supply chain and does not stop at your own network perimeter.

Source

• cloud.google.com