Widely attributedUnknownUNC2814
Suspected China-nexus cyber espionage group tracked by Google Threat Intelligence Group since 2017. Known for targeting telecommunications and government organisations across 42 countries using the GRIDTIDE backdoor which abuses Google Sheets API for covert C2 communications.
Attribution signal
?Score = mentions × confidence weight, summed across all attributed sources. Higher source diversity increases the score.≥ 10 High≥ 3 Moderate< 3 LowAttribution signals
3 mentions · 1 source"we recently observed UNC2814 use this form of expert persona prompting by directing the model to act as a senior security auditor or C/C++ binary security expert."
"We assess the targeting of PII in this engagement is consistent with cyber espionage activity in telecommunications, which is primarily leveraged to identify, track, and monitor persons of interest."
"The threat actor, UNC2814, is a suspected People's Republic of China (PRC)-nexus cyber espionage group that GTIG has tracked since 2017."
Hedge terms observed