How Google Stopped a Hacking Group: Risks and 3 Protection Tips

How Google Stopped a Hacking Group_ Risks and 3 Protection Tips

How Google Stopped a Hacking Group: Risks and 3 Protection Tips

Discover how Google thwarted the UNC2814 hacking group and learn essential tips to protect yourself from data breaches and unwanted surveillance.

By

One of the definitions of “hack” is “heavy blows.” Well, true to its meaning, hacking does deal a heavy blow to the people and organizations that are targeted. It leads to financial loss, data theft, legal actions, and more.

Google has halted UNC2814 from attacking government agencies and telecom companies. The risks of these attacks are data exposure and unwanted surveillance. You can protect yourself by using secure messaging apps, protecting your information, and updating your

According to VikingCloud, as of 2026, over 70% of organizations have reported an increase in cyberattack frequency. Experts expect cybercrime damages to increase annually, largely due to human error and the growing number of phishing sites created each month.

The Hackers: UNC2814

The Hackers_ UNC2814

So, who are the hackers?

UNC2814 is a long-running and high-profile espionage group that’s capable of large-scale intrusions. Experts believe that this group is aligned with Beijing-linked interests.

The group often maintains persistent access to systems, with the goal of monitoring communications or stealing sensitive information. They focus on targeting government organizations and telecommunication companies across Asia, Africa, Europe, and the Americas.

What Happened? The Spying Campaign

What Happened_ The Spying Campaign

In a campaign, UNC2814 used legitimate Google Sheets API calls, turning them into a command-and-control infrastructure. This allowed them to disguise the malicious traffic as a normal network activity, helping them avoid detection.

With this, the group already has access in 42 countries. But according to Charley Snyder (senior manager of Google Threat Intelligence Group), they suspect that the group has access to at least 20 more countries, causing multiple data breaches.

In one data breach, UNC2814 was able to expose sensitive data. They installed the GRIDTIDE backdoor on a system that contains personal identifiers. They were aiming to track select people by leveraging telecommunication surveillance. The affected sensitive data are as follows:

  • Names
  • National ID numbers
  • Dates of birth
  • Place of birth
  • Phone numbers
  • Voter ID
  • Call records
  • SMS messages

There were over 50 entities affected. However, the names of the affected companies remain undisclosed.

With this, Google, with unnamed partners, has terminated Google Cloud projects that UNC2814 was controlling. Plus, Google has identified and disabled the internet infrastructure nd the accounts that the hackers were using to access Google Sheets.

The 2 Risks

The 2 Risks

Now, why should you care about this issue? You should care because while regular people like you are not the direct targets of these hackers, you can still be affected when government agencies and telecom companies are breached.

Here are two risks from hacking attacks:

  • Risk No. 1: Data Exposure: When hackers attack the government and companies, it puts your personal data at risk, such as your name, address, contact details, and even more sensitive information (e.g., financial details, national IDs, voter IDs, etc.). Bad actors can use your information for identity theft, scams, or they can sell it on the dark web, exposing you to more threats.
  • Risk No. 2: Unwanted Surveillance: As mentioned earlier, hackers even monitor call records and SMS messages. If you’re affected, hackers will be able to spy on what you tell others and with whom you’re talking, putting even the people you care about at risk.

3 Things You Can Do

3 Things You Can Do

While you shouldn't shoulder the responsibility of stopping these hacking groups, there are still things you should do to minimize exposure and protect yourself.

  • Protection No. 1: Use Secure Communications: Make sure that you use trusted and secure communication apps. For example, look for apps like Signal, which uses end-to-end encryption. Also, it will be ideal to use two-factor authentication, or 2FA, to avoid SIM swap attacks in case hackers steal call logs.
  • Protection No. 2: Protect Personal Data: Hacks can lead to data breaches. And if a company that has your data gets targeted, then you’ll be at risk. So, protect your data. You can do this by limiting what you share online or on social media platforms, and by opting out of data brokers (companies that collect, share, and sell your information). You can also protect your information by using a VPN and by freezing your credit in case of a data breach.
  • Protection No. 3: Improve Device Hygiene: Make sure your devices are secure. This means keeping your phone, laptops, and apps updated and patching vulnerabilities that hackers may exploit. Also, review every app permission to block any unnecessary access to your data (e.g., contacts or location data). Also, practice verifying communications to avoid accidentally clicking malicious links from phishing emails.

Conclusion

UNC2814 is just one of many hacking groups that have been threatening our privacy and safety. So, you should stay alert and proactive in protecting yourself by limiting data sharing, improving your device hygiene, and using secure information.

Frequently Asked Questions

What is China’s response to hacking claims?

According to a spokesperson from a Chinese Embassy, China “consistently opposes hacking activities, and combats them in accordance with the law.” Additionally, China rejects any attempt to use cyber issues to taint the country.

Who are the top 5 hackers in history?

Here are the 5 most famous hackers in history: 1) Kevin Mitnick, 2) Astra, 3) Gary McKinnon, 4) Steve Wozniak, and 5) Adrian Lamo.

Which countries have the strongest hackers?

Some of the countries with the most advanced hackers include: 1) China, 2) North Korea, 3) Russia, and 4) Israel. These countries contribute widely to shaping the global cyber threat landscape. They often use rapid exploitation of unpatched systems and automated intrusion mechanisms.