(Credit: Jakub Porzycki/NurPhoto via Getty Images)
Google says a Chinese hacking group infiltrated telecommunications and government groups in at least 42 countries, likely to spy on specific individuals.
The group, dubbed UNC2814, “impacted 53 victims,” and was found secretly placing a backdoor onto devices containing personal information, such as names, phone numbers, and national ID numbers, Google warned in a Wednesday report.
“We expect UNC2814 used this access to exfiltrate a variety of data on persons and their communications,” the company added. “The access UNC2814 achieved during this campaign would likely enable clandestine efforts to similarly surveil targets.”
The company also mapped the intrusions. Although North America wasn’t affected, Google identified “suspected targeting in at least 20 other nations," which were left unnamed. “This prolific scope is likely the result of a decade of concentrated effort,” Google added.
(Credit: Google)The campaign brings to mind Salt Typhoon, another notorious Chinese hacking group that infiltrated numerous telecommunication companies to spy on politicians, including Donald Trump’s phone. However, Google suspects UNC2814 operates as a separate entity.
“It is important to highlight that UNC2814 has no observed overlaps with activity publicly reported as ‘Salt Typhoon,’ and targets different victims globally using distinct tactics, techniques, and procedures,” the company said.
Google has been tracking UNC2814 since 2017 and discovered the group’s most recent hacking campaign after the company’s security software flagged suspicious activity on a customer’s Linux-based server. The investigation led Google security researchers to uncover a sophisticated backdoor from UNC2814 that can remotely execute commands and download and upload files.
(Credit: Google)The backdoor, dubbed Gridtide, is written in the C programming language, suggesting it’s designed to target Linux-based software. To evade detection, the backdoor uses a legitimate API in Google Sheets as a disguised communication channel to receive commands and send data to the Chinese hackers.
In response, the company said it worked with partners to shut down the spying campaign, including terminating the hacking group’s access to the Google Sheets API and other company products. Google has also issued formal victim notifications, while Wednesday’s report contains technical details about UNC2814’s backdoor and the group’s other tactics, including the use of a VPN component.
It's unclear how the Chinese hackers initially gained access to the victim network, but Google says, “UNC2814 has a history of gaining entry by exploiting and compromising web servers and edge systems.”