Google dismantles Chinese hacking group, affecting at least 53 groups worldwide.

Author：中央社 / 譯者：李佩珊

  Source of the first image：shutterstock

Google announced on the 25th that it had dismantled a Chinese-linked hacking group that had compromised at least 53 organizations in 42 countries around the world.

According to findings exclusively shared by Google and Reuters, the hacker group, tracked as UNC2814 and "Gallium," has been infiltrating government agencies and telecommunications companies for nearly 10 years.

John Hultquist, principal analyst at Google Threat Intelligence Group, said: "This is a massive surveillance mechanism used to spy on individuals and organizations around the world."

Google, along with an unnamed partner, terminated the Google Cloud project controlled by a hacker group, identified and disabled the network infrastructure used by the group, and deactivated the accounts the group used to access Google Sheets. The group used these accounts to target individuals and steal data.

Google added that the use of Google Sheets allowed the organization to evade detection and blend into normal network traffic, and that this did not involve any Google product being compromised.

Charley Snyder, senior manager of Google’s Threat Intelligence Group, said the group has identified 53 unnamed entities in 42 countries and may have gained access in at least 22 other countries during the dismantling operation.

Snyder declined to reveal the identity of the victimized entity, but mentioned that in one case, the organization installed a backdoor program called GRIDTIDE by Google in a system that included full names, phone numbers, dates of birth, places of birth, voter ID numbers, and identity card numbers.

Google stated that these targeted actions are consistent with actions to identify and track specific targets, adding that "similar activities have been used to steal call logs, monitor text messages, and even monitor specific individuals through the legitimate blocking capabilities of telecommunications operators."

Liu Pengyu, spokesperson for the Chinese Embassy in the United States, stated in a statement: "Cybersecurity is a common challenge faced by all countries and should be resolved through dialogue and cooperation."

Liu Pengyu said, "China has always opposed and cracked down on hacking activities in accordance with the law, and at the same time firmly opposes attempts to smear or defame China by using cybersecurity issues."

Google stated that this campaign differs from another high-profile Chinese hacking operation targeting the telecommunications sector, known as "Salt Typhoon." The US government believes "Salt Typhoon" is linked to China and has targeted hundreds of US organizations and prominent political figures.