UNC2814’s GRIDTIDE: How Chinese Cyberspies Used SaaS APIs to Breach Telecoms and Governments

A wave of cyber espionage has swept through dozens of telecom firms and government agencies, orchestrated by the Chinese-linked group UNC2814. What sets this campaign apart isn’t just the scale, but the ingenuity: attackers leveraged everyday cloud tools—like Google Sheets APIs—to hide their tracks and maintain covert control over compromised systems. The GRIDTIDE backdoor, a custom C-based malware, authenticated directly with Google’s cloud using a hardcoded private key, blending malicious activity with legitimate business traffic. This allowed UNC2814 to sidestep traditional security measures, making detection a game of cat and mouse for defenders.

By embedding their command-and-control (C2) operations within trusted SaaS platforms, the attackers not only evaded firewalls and endpoint protections but also demonstrated how modern cyber threats are evolving alongside the tools organizations rely on every day. The campaign’s sophistication highlights the urgent need for organizations to rethink their security strategies, especially as cloud adoption and API integrations become the norm.

How UNC2814 Used SaaS APIs and GRIDTIDE to Outsmart Traditional Defenses

Exploiting SaaS APIs for Stealthy Command and Control

UNC2814’s campaign demonstrated a sophisticated abuse of Software-as-a-Service (SaaS) APIs, specifically the Google Sheets API, to facilitate covert command-and-control (C2) operations. By embedding malicious communications within legitimate SaaS traffic, the threat actor was able to bypass many traditional security mechanisms that typically monitor for suspicious network activity. The GRIDTIDE backdoor, written in C, authenticated to Google’s cloud infrastructure using a hardcoded private key, allowing it to interact programmatically with Google Sheets as a C2 channel.

This approach provided several advantages:

• Legitimate Traffic Camouflage: API calls to Google Sheets appeared as normal SaaS usage, blending in with routine business operations and evading detection by perimeter firewalls and proxy-based monitoring solutions.
• Encrypted Communication: Data exchanged between GRIDTIDE and the attacker’s infrastructure was encrypted via HTTPS, further complicating traffic inspection and analysis.
• Dynamic Infrastructure: By leveraging cloud-based spreadsheets, UNC2814 could rapidly change C2 endpoints or migrate operations with minimal risk of detection or disruption.

This table highlights the comparative stealth and flexibility of SaaS API-based C2 channels versus traditional approaches.

GRIDTIDE’s Operational Workflow: Sanitization, Reconnaissance, and Persistence

Upon execution, GRIDTIDE initiated a series of actions designed to both conceal its presence and establish persistent control over compromised systems. The malware’s workflow included:

• Spreadsheet Sanitization: GRIDTIDE deleted the first 1,000 rows and columns A to Z in the target spreadsheet, likely to remove traces of prior activity and ensure a clean workspace for new operations.
• Host Reconnaissance: The malware collected detailed host information, including username, hostname, operating system details, local IP address, locale, and timezone. This data was logged in cell V1 of the spreadsheet, providing the attackers with situational awareness of infected hosts.
• Polling and Command Execution: GRIDTIDE continuously polled cell A1 for new commands. If a command was present, it executed the specified action—such as running Base64-encoded bash commands—and wrote the output back to the spreadsheet. If no command was found, it reduced polling frequency to random intervals between 5 and 10 minutes, minimizing anomalous activity that might trigger detection.

Evasion of Traditional Security Controls

UNC2814’s use of SaaS APIs and GRIDTIDE’s operational design enabled the campaign to circumvent multiple layers of traditional network and endpoint defenses. Key evasion techniques included:

• Bypassing Perimeter Defenses: Since GRIDTIDE communicated with Google’s legitimate infrastructure, perimeter security appliances such as firewalls and intrusion detection/prevention systems (IDS/IPS) typically allowed this traffic by default, as blocking it would disrupt legitimate business functions.
• Avoiding Signature-Based Detection: The use of a hardcoded private key for authentication and the dynamic nature of API interactions made it difficult for signature-based endpoint protection solutions to identify malicious activity.
• Minimizing Behavioral Anomalies: By reducing polling frequency during idle periods and sanitizing spreadsheet content, GRIDTIDE minimized behavioral anomalies that could be flagged by security analytics platforms.

Adaptive C2 and Operational Resilience

A notable aspect of the UNC2814 campaign was its operational resilience, achieved through adaptive command-and-control infrastructure:

• Cloud Project Rotation: Attackers could quickly rotate Google Cloud projects and spreadsheets, enabling them to recover from infrastructure takedowns or detection events with minimal operational downtime.
• API Key Management: The use of hardcoded private keys allowed for rapid re-authentication and migration to new projects, further complicating efforts to fully disrupt the campaign.
• Sinkholing and Disruption Response: Even after Google and its partners terminated known malicious projects and revoked API access, UNC2814 was expected to resume operations using new infrastructure, demonstrating a high degree of agility.

Implications for Detection and Response Strategies

The UNC2814 campaign’s innovative use of SaaS APIs and GRIDTIDE’s design highlight critical gaps in conventional security postures. To address these challenges, organizations must:

• Enhance SaaS Visibility: Implement monitoring solutions capable of analyzing SaaS API usage for anomalous patterns, such as unusual spreadsheet activity or API calls from unexpected hosts.
• Behavioral Analytics: Deploy advanced behavioral analytics to detect subtle deviations in user and system behavior, such as irregular spreadsheet modifications or infrequent polling intervals.
• Zero Trust Principles: Adopt zero trust architectures that enforce strict access controls and continuous validation of user and device identities, even for traffic to trusted cloud services.
• Collaborative Threat Intelligence: Leverage shared threat intelligence from vendors and industry partners to rapidly identify and respond to emerging SaaS-based attack techniques.

The sophistication of UNC2814’s approach underscores the need for defenders to move beyond traditional perimeter and signature-based defenses, embracing cloud-native security controls and advanced analytics to counter the evolving threat landscape.

Final Thoughts

UNC2814’s campaign is a wake-up call for organizations relying on traditional security controls. By exploiting SaaS APIs and deploying adaptive malware like GRIDTIDE, these attackers have shown that blending into legitimate cloud traffic is not just possible—it’s highly effective. The ability to rotate cloud projects, sanitize evidence, and evade detection through behavioral subtlety underscores the growing complexity of defending against state-sponsored threats.

To stay ahead, defenders must embrace cloud-native security tools, behavioral analytics, and collaborative threat intelligence. The future of cybersecurity will hinge on our ability to spot the wolf in sheep’s clothing—malicious actors hiding in plain sight within the cloud services we trust most.

References

• Chinese cyberspies breached dozens of telecom firms, govt agencies in global espionage campaign. (2026). BleepingComputer. https://www.bleepingcomputer.com/news/security/chinese-cyberspies-breached-dozens-of-telecom-firms-govt-agencies/