Google has disrupted a Chinese-linked hacking group accused of breaching at least 53 organizations across 42 countries, dismantling infrastructure used in a years-long cyber espionage campaign. The operation, tracked by Google researchers as UNC2814 and “Gallium,” allegedly targeted government bodies and telecommunications providers to collect sensitive personal and communications data.
According to findings released by Google Threat Intelligence Group, the group maintained a nearly decade-long history of infiltrating high-value networks. John Hultquist, the unit’s chief analyst, described the activity as a “vast surveillance apparatus” designed to monitor individuals and institutions globally.
Google and its partners moved to terminate malicious projects hosted on Google Cloud, while also identifying and disabling internet infrastructure and user accounts leveraged by the hackers. Investigators found the group had used Google Sheets as part of its operational toolkit, allowing it to blend activity into normal network traffic and evade detection. The company emphasized that this technique did not represent a vulnerability in Google products but rather an abuse of legitimate services.
Security analysts confirmed the attackers had gained access to dozens of entities, with potential footholds in at least 22 additional countries before the disruption took place. In one instance, the group deployed a backdoor tool known as “GRIDTIDE” on a compromised system containing highly sensitive personal records, including names, phone numbers, birth details, and national identification data.
Researchers said the targeting patterns suggested an effort to identify, track, and monitor selected individuals, with tactics resembling past campaigns used to extract call records, intercept SMS traffic, and exploit telecommunications surveillance capabilities.
Responding to the allegations, Chinese Embassy spokesperson Liu Pengyu said cybersecurity is a shared global challenge that should be addressed through dialogue and cooperation. He added that China opposes hacking and rejects attempts to use cyber issues to “smear or slander” the country.
Google noted that the activity is separate from another high-profile China-linked cyber campaign previously identified by U.S. authorities, underscoring the scale and complexity of state-associated digital espionage threats facing governments and critical infrastructure worldwide.
