UNC2814 GRIDTIDE Campaign 53 Breaches 2026

The UNC2814 GRIDTIDE campaign compromised at least 53 organizations across 42 countries, primarily targeting international governments and global telecommunications organizations. The campaign spanned Africa, Asia, and the Americas, with Google and industry partners disrupting the threat actor's infrastructure in February 2026. The actor demonstrated persistence and evasion capabilities across multiple regions over an extended operational period.

Google attributed the campaign to UNC2814, a suspected China-nexus cyber espionage group with a history of targeting government and telecommunications sectors. The attack chain involved unauthorized access to organizational networks, though specific initial access vectors and exploitation techniques were not detailed in the disclosure. The campaign's primary objective appeared to be cyber espionage, though specific data types exfiltrated were not enumerated.

Google confirmed infrastructure disruption through coordinated action with industry partners in February 2026. The takedown operation targeted UNC2814's operational capabilities, though the group's complete neutralization status remains unspecified. The disclosure serves as a public notification to affected organizations across the 42 impacted countries.