In summary:
- PCWorld reports on how Google disrupted a sophisticated international spy ring called ‘GRIDTIDE’ that exploited Google Sheets as a backdoor for espionage.
- The China-affiliated group UNC2814 used the Sheets API to collect usernames, hostnames, and IP addresses from victims across 42 nations.
- This cyberattack targeted 53 entities including telecommunications and government agencies, demonstrating how common tools can enable sophisticated state-sponsored espionage campaigns.
The humble spreadsheet is a staple of modern work, one you probably barely think about. But with global systems intimately interconnected, and only growing more so, it seems almost anything can be an attack vector. Such is the case with Google Sheets. Google reports that it disrupted a wide-ranging cyberattack that used the web app as a backdoor to spy on users.
Google’s Threat Intelligence Group, working with the Mandiant team (which Google purchased in 2022), points the finger at UNC2814, a China-affiliated group that’s been operating for almost a decade. According to the report, the hackers created a backdoor using the Google Sheets API, allowing it to collect usernames, hostnames, IP addresses, and other information. There was no “infection” in the layman’s sense—this was more of a state-sponsored espionage campaign than a deliberate attempt at theft or sabotage.
The report claims the “GRIDTIDE” system has been in place since 2023, with verified intrusions in 42 nations and 53 specific targets, with 20 nations suspected as other targets. “This prolific scope is likely the result of a decade of concentrated effort,” says Google, with a focus on telecommunications and government agencies.
The system has been disrupted, or at least is currently inoperable as best as the Threat Intelligence Group can tell. Accounts used to deploy the GRIDTIDE system have been shut down, plus the underlying domains and infrastructure, with affected victims notified formally.
Author: Michael Crider, Staff Writer, PCWorld
Michael is a 15-year veteran of technology journalism, covering everything from Apple to ZTE. On PCWorld he's the resident keyboard nut, always using a new one for a review and building a new mechanical board or expanding his desktop "battlestation" in his off hours. Michael's previous bylines include Android Police, Digital Trends, Wired, Lifehacker, and How-To Geek, and he's covered events like CES and Mobile World Congress live. Michael lives in Pennsylvania where he's always looking forward to his next kayaking trip.