China's Google Sheets Spy Game: How Hackers Turned Spreadsheets into Secret Weapons for a Decade

This is your Digital Frontline: Daily China Cyber Intel podcast. Hey listeners, Ting here on Digital Frontline, your go-to for China cyber intel. Buckle up, because the past 24 hours dropped a bombshell: Google Threat Intelligence Group and Mandiant just dismantled UNC2814, a sneaky China-linked crew that's been burrowing into telecoms and governments like digital moles for a decade. Picture this: these hackers, tracked since 2017, hit 53 orgs in 42 countries—Africa, Asia, Americas, you name it—using GRIDTIDE, a slick C-based backdoor that hijacks Google Sheets API for command-and-control. No exploits, just pure cunning: malware polls cell A1 for orders, dumps recon into V1, shuttles files via nearby cells, all masquerading as legit SaaS chatter. Google calls it "prolific and elusive," with suspected hits in 20 more nations, eyeing personally identifiable info for spying on dissidents and VIPs. Think call records, SMS intercepts—classic espionage to track persons of interest. And get this, Singapore confirmed all four major telcos got popped in a coordinated blitz, per Xage's February roundup. Targeted sectors? Telecoms and governments are ground zero, but it's rippling to critical infrastructure. Poland's wind farms and solar grids got owned last December via default creds—no MFA, exposed interfaces—and CISA's yelling at U.S. energy ops to lock it down. Meanwhile, OpenAI's fresh report exposes a Chinese law enforcement account feeding ChatGPT "cyber special operations" reports, plotting harassment against critics worldwide, even a propaganda hit on Japan's Sanae Takaichi. Hundreds of staff, thousands of fake accounts flooding platforms with bogus complaints, forging docs, impersonating U.S. officials. Another cluster from mainland China, using Simplified Chinese prompts, drafted phishing emails from fake Hong Kong firm Nimbus Hub Consulting, luring U.S. state officials and finance wonks to WhatsApp or Zoom for "consults"—and one even begged for FaceFusion deepfake install guides. Expert take? Google warns UNC2814's decade-long grind means they'll claw back fast; they already disrupted by nuking Cloud projects, sinkholing domains, and notifying victims. Mandiant spotted GRIDTIDE first, confirming no Salt Typhoon overlap—different TTPs, same espionage vibe. OpenAI notes threat actors mix ChatGPT with local AIs like DeepSeek for influence ops, not full hacks yet, but it's amplifying scams and recon. For you businesses and orgs: Patch edge servers yesterday—UNC2814 loves 'em. Enforce MFA everywhere, segment IT/OT, ditch defaults, monitor SaaS APIs for weird Sheets traffic. Scan for GRIDTIDE IOCs Google released, hunt PII exfil, and lock AI agent auth—think OpenClaw flaws or rogue Chrome extensions. Telecoms, audit lawful intercept; energy, harden remote sites. Stay vigilant, listeners—China's playbook is living-off-the-land stealth. Thanks for tuning in—subscribe for daily drops! This has been a Quiet Please production, for more check out quie This content was created in partnership and with the help of Artificial Intelligence AI.