Key Points:
- Google shut down a massive cyber espionage campaign linked to China.
- The hackers breached at least 53 organizations across 42 different countries.
- The group used Google Sheets to hide their tracks and steal data.
- Hackers stole personal information like national ID numbers and phone records.
Google successfully stopped a major hacking group linked to China. The tech giant announced on Wednesday that this group breached at least 53 organizations spread across 42 different countries.
Security experts track this specific group under the names UNC2814 and Gallium. For nearly ten years, these hackers have actively targeted government agencies and telecommunication companies around the world. John Hultquist, a chief analyst at Google, described their operation as a massive surveillance machine built to spy on people globally.
To take the group offline, Google teamed up with several partners. Together, they shut down the internet infrastructure the hackers relied on to operate. They also terminated specific Google Cloud projects and disabled accounts that the group used to access Google Sheets.
The hackers cleverly used Google Sheets to blend their data theft into normal internet traffic. Google clarified that this tactic did not mean its actual products had security flaws. Instead, the attackers simply used public tools to hide their daily activities.
Charlie Snyder, a senior manager at Google, noted the group might have possessed access to networks in 22 additional countries. In one confirmed case, the hackers planted a secret backdoor called GRIDTIDE. This entry point let them steal full names, birth dates, phone numbers, and voter ID numbers.
Security teams believe the hackers wanted to track specific individuals. The attackers tried to steal call records, read text messages, and even hijack the lawful monitoring systems that phone companies use for police investigations.
Chinese Embassy spokesperson Liu Pengyu quickly denied the accusations. He stated that China actively fights hacking and rejects these claims as slander. Meanwhile, Google made it clear that this group operates completely separately from Salt Typhoon, another Chinese hacking ring that recently targeted American political figures.
