- The Chocolate Factory announced the Google Threat Intelligence Group-led actions on Wednesday and said that, in partnership with other teams, it terminated all Google Cloud Projects that had been controlled by UNC2814, a group that GTIG has tracked since 2017. They also disabled all known UNC2814 infrastructure and accounts, and revoked access to the Google Sheets API calls used by the Chinese snoops for command-and-control (C2) purposes.
- “As of Feb. 18, GTIG’s investigation confirmed that UNC2814 has impacted 53 victims in 42 countries across four continents, and identified suspected infections in at least 20 more countries,” the threat hunters said in the report.
- The security sleuths uncovered this campaign during a Mandiant investigation into suspicious activity in a customer’s environment. Specifically, this binary, “/var/tmp/xapt,” initiated a shell with root privileges, and then executed a command to retrieve the system’s user and group identifiers to confirm it had successfully escalated to root.
- Google suspects the payload was named xapt, after the command-line tool in Debian and Ubuntu systems, to make it easier to hide in the victim’s environment and look like a legitimate tool.
- The intruders also used a novel backdoor, Gridtide, that abuses legitimate Google Sheets API functionality to disguise its command-and-control (C2) traffic. Mandiant has linked Gridtide to UNC2814.
- The intruders also used a novel backdoor, Gridtide, that abuses legitimate Google Sheets API functionality to disguise its command-and-control (C2) traffic. Mandiant has linked Gridtide to UNC2814.
- After breaking in, the spies moved laterally via SSH, performed reconnaissance, escalated privileges, and then deployed the Gridtide backdoor using a command, “nohup ./xapt,” that allows it to run even after the user closes the session.
- “Subsequently, SoftEther VPN Bridge was deployed to establish an outbound encrypted connection to an external IP address,” the threat intel team wrote. “VPN configuration metadata suggests UNC2814 has been leveraging this specific infrastructure since July 2018.”
- The C-based backdoor uses Google Sheets as its C2 platform, can execute shell commands, and can upload and download files. In this case, the attacker deployed Gridtide on an endpoint containing personal information - likely to identify and track persons of interest - including full name, phone number, date and place of birth, voter ID and national ID numbers.
Can we do tge same for NSA, CIA FBI, ICE and all the other (and kill palantir in the process) if spying is wrong ? Or is it just that the US empire of doom is good in doing so ?
What are your thoughts on the Chinese state-sponsored espionage group from this post?
Same shit as any state sponsored espionage, we would all be better getting rid of them , including CLOUD, FISA and PATRIOT acts.
I saw when you said America Bad the first time too. Do you have any insights about the contents of this post?
Is spying wrong, Melusine?
Tagging in here cause youre obtuse af
Inherently? No. Its always a manner of why and how, whats to gain, whats done with it after, ect.
Like literally everything else morality is a construct determined by every factor that makes it up, every influence, every refraction, of every effect it had over infinity
Punching you in the face, moral? Idk, maybe. It depends I guess
Do you understand a little better? Now stop the posturing games once you calm tf down plz
Okay, if you don’t know if spying is wrong, then you should inform @[email protected] that they are the one doing some strange posturing over here.
Would you care to comment on the morality of the CCP based on the article here, or is this just a virtue-signaling zone?
deleted by creator
Damn. How long were those sheets?
I was confused at first, thinking that somehow Sheets’ systems were compromised.
The C-based backdoor uses Google Sheets as its C2 platform, can execute shell commands, and can upload and download files.
Instead, Sheets is just the command and control relay.
Which is pretty weird, though.
I dunno, it’s very innocuous-looking from a traffic inspection standpoint, while also being a resilient way of storing an equally-innocuous-looking CSV. Kinda clever, if you ask me.
Peviously posted on an another lemmy community.
Great that we don’t need any oversight anymore. Big shit Corp can just point their fingers at their ‘Enemies’ and Merika have judged and convicted the ‘enemy’. No evidence or certainty needed. Neat trick, and brilliant for setting the scene and hate for a conflict. At some point the claims get incredibly dumb, but at that point some people have eaten the blue pill and refuse to hear anything else…
Curios that NSA or other Merican 3-letter agencies are never mentioned even though we know for a fact that they do this all the time while letting signs point to China, Russia, Iran or whoever they feel are ‘Enemies’ atmo… But, say it enough times and the manipulation sticks.
Interesting take. I didn’t even register the coup until you pointed it out. It might be the dawn of corporates with pointy fingers for pointing out culprits and a broad willingness to take the bait.
