Google’s Threat Intelligence Group (GTIG), Mandiant, and partners disrupted a global espionage campaign attributed to a suspected Chinese threat actor that used SaaS API calls to hide malicious traffic in attacks targeting telecom and government networks.
The campaign has been active since at least 2023 and has impacted 53 organizations in 42 countries, with suspected infections in at least 20 more countries.
The initial access vector is unknown, but the researchers note that the threat actor, which Google tracks internally as UNC2814, has previously gained access by exploiting flaws in web servers and edge systems.







