Google Unmasks, Disrupts Group Using Sheets for Command-and-Control Purposes
Likely Chinese nation-state hackers used online spreadsheets as infrastructure for hacking campaigns that affected at least 53 telecom operators across 42 countries, Google disclosed Wednesday.
See Also: Why HSMs Are Critical to Digital Asset Security
Threat researchers at Google said telecoms in 20 or more other countries may also have fallen victim to the campaign, mounted by a threat actor the computing giant tracks as UNC2814.
Working with industry partners, Google disrupted the apparent cyberespionage operation by blocking infrastructure being used to facilitate the activity. “This included the sinkholing of both current and historical domains used by the group in order to further dismantle UNC2814’s access to compromised environments,” it said.
Google said it notified suspected victims directly and released indicators of compromise. UNC2814 appears to be affiliated with Beijing and has been expanding the footprint of this particular campaign since at least 2017.
Telecoms confirmed or suspected of falling victim to this UNC2814 campaign are located in countries across Central and South America, Africa, Europe and Asia, including Russia.
Mandiant discovered a backdoor, which it dubs “Gridtide,” used by hackers in the wild. The malware is designed to use Google Sheets, the company’s free, cloud-based spreadsheet software, for command-and-control. Hackers used the spreadsheet API to convert the service into a communication channel relaying shell commands and the transfer of stolen data.
“Gridtide hides its malicious traffic within legitimate cloud API requests, evading standard network detection,” researchers said.
Google emphasized that Gridtide doesn’t exploit any vulnerability in Sheets. Attackers could easily have used another cloud-based spreadsheet for C2 purposes. After gaining initial access to an endpoint and infecting it with Gridtide, researchers said that in cases dating from at least July 2018, attackers installed open source SoftEther VPN Bridge to encrypt all C2 communications with an external IP address.
How attackers gained initial access to a victim’s network remains unclear. Researchers said the group’s typical tradecraft involves “exploiting and compromising web servers and edge systems.”
Such devices remain a repeat motif in nation-state hacking campaigns. Attackers have continued to exploit misconfigurations, known flaws and sometimes zero-day vulnerabilities in edge equipment, which often lacks endpoint detection and response safeguards or proper monitoring by internal security teams (see: CISA Directs Federal Agencies to Update Edge Devices).
What the attackers did after gaining access also isn’t fully clear. Many cyberespionage operations tied to China that target telecoms involve exfiltration of call records, SMS messages and information captured using lawful intercept equipment.
The goal of such campaigns appears to be harvesting data “to enable the targeting of individuals and organizations for surveillance efforts, particularly dissidents and activists, as well as traditional espionage targets,” researchers said.
Multiple telecoms targeted in the campaign reported discovering that the attackers’ haul included personally identifiable information. “In multiple confirmed compromises, the group targeted highly sensitive PII, including national and voter ID numbers,” Google told Information Security Media Group.
None of the tactics, techniques or procedures used by UNC2814, or any of its targeted victims, overlaps with the long-running, China cyberespionage operation tracked as “Salt Typhoon,” which has counted many Western telecoms as victims, researchers said.
Multiple Western government agencies have suggested Salt Typhoon, like many Chinese cyberespionage efforts, is administered by state security and intelligence services, but relies heavily on private domestic cybersecurity contractors (see: Norway Says Salt Typhoon Hackers Hit Vulnerable Systems).
While UNC2814’s operators will almost certainly attempt to reboot their nearly decade-long efforts, Google said this disruption should stand as a serious setback. “Prolific intrusions of this scale are generally the result of years of focused effort and will not be easily reestablished,” it said.