Imagine you are a Level 1 Security Operations Center (SOC) analyst at one of Nigeria’s major telecommunications companies. It’s 2:00 AM on a Tuesday shift. You’re staring at endless streams of firewall logs, hunting for anything out of the ordinary.
Suddenly, your dashboard flags an outbound HTTPS connection from an internal backend server.
You check the destination: sheets.googleapis.com. You pause. Google Sheets? It’s probably just a project manager running an automated financial model or an IT script backing up server metrics to a cloud spreadsheet. It’s trusted Google traffic. You hit ‘Resolve’, clear the alert, and take a sip of your coffee.
Except, that wasn’t a backup script. That was an advanced state-sponsored hacker walking right out the front door with thousands of your subscribers’ call records.
The threat actor: Who is UNC2814?
This isn’t a hypothetical scenario. Over the past few days, a massive revelation hit the global cybersecurity community, backed by forensic intelligence from Google’s Threat Intelligence team and our very own Computer Security Incident Response Team for the Nigerian telecommunications sector (NCC-CSIRT).
A highly sophisticated, suspected state-sponsored group known as UNC2814 has been systematically breaching telecommunications operators across the globe— including right here in Africa.
The UNC2814, suspected to be a China-backed espionage group, has targeted international governments and global telecommunications organizations across Africa, Asia, and the Americas and has been in operation since 2017.
Their weapon of choice? A stealthy, custom-built malware backdoor called GRIDTIDE, which is a sophisticated, C-based backdoor malware used in global cyber espionage campaigns.
Usually, when hackers breach a network, they need to communicate with their malware to issue commands and extract stolen data. They set up ‘Command and Control’ (C2) servers.
But as cybersecurity professionals know, if a server in your network suddenly starts sending massive amounts of data to a random, unverified IP address in a foreign country, firewalls will instantly block it.
However, this China-backed threat actor, UNC2814, realized something brilliant and terrifying: Why build a shady hacker server when you can just use Google?
How China’s UNC2814 used GRIDTIDE malware to exploit Google sheet and launch cyber attacks
GRIDTIDE uses the official Google Sheets API as its C2 infrastructure.
C2 infrastructure, also known as Command and Control, is the digital communication network cybercriminals use to maintain connectivity with compromised devices after an initial breach. It acts as a remote control, allowing attackers to issue instructions, download payloads, and exfiltrate stolen data while evading network defenses.
However, cybersecurity professionals are trained to dictate these breaches, and properly flag them and prevent them from spreading.
But to stay evasive, UNC2814 utilizes the GRIDTIDE, a malware designed to covertly execute shell commands, upload/download files, and perform host reconnaissance without alerting standard network defenses. Instead of traditional command-and-control (C2) servers, GRIDTIDE uses the Google Sheets API as a communication channel
The malware collects sensitive data from the telecom server, encrypts it securely using AES-128, and then simply ‘‘writes’’ that encrypted data into specific cells of a standard Google Spreadsheet hosted in the cloud. The attackers, sitting miles away, just open their Google Sheet and read the cells to get the stolen data. To send instructions, they type shell commands into a cell, and the malware ‘‘reads’’ the spreadsheet to execute them. It’s a perfect disguise.
Also Check: How Kenya Recorded 4.6 Billion Cyber Threats in the Last Three Months of 2025
How China’s UNC2814 attacks telecom infrastructure
When we talk about hacking ‘telecommunications,’ a lot of people outside the industry get confused. There is a persistent myth that regular voice calls and SMS text messages travel over some magical, closed-off radio network that is completely separate from the Internet. So, how can an internet-based hacker listen to ‘normal’ phone calls?
Let’s break it down in simple terms. Yes, the link between your smartphone and the MTN or Airtel mast on your street is a radio frequency. But once your call hits that mast, it is immediately digitized.
Modern telecommunications networks are essentially just massive, highly complex IT networks.
The ‘Core Network’ that routes your voice calls, delivers your SMS, and calculates your airtime billing is powered by thousands of standard Linux servers, massive SQL databases, and IP-based routers.
UNC2814 didn’t try to intercept radio waves out of the air like a spy movie. They attacked the telecom company’s corporate IT network. They breached the data centers. Once they gained ‘root’ (administrator) access to the backend Linux servers, they had direct access to the Call Detail Records (CDRs).
This means they could see exactly who you called, when you called them, how long you spoke, and read the metadata of your SMS messages, all by querying a database.
Also Check: How 82% of Cybersecurity Skill Gap Is Costing Africa Billions Of Dollars Annually
The impact in Nigeria and beyond
The scale of this espionage is staggering. Google confirmed intrusions across 53 victim organizations in 42 countries. Here at home, the NCC-CSIRT issued Advisory NCC-CSIRT-2026-009 in July, explicitly warning the nation about this campaign.
The advisory made it clear: Nigerian and African telecom operators were actively targeted. The goal wasn’t to steal money or disrupt services; it was pure surveillance. By sitting silently in these networks for months or even years, these actors could track the communications of government officials, business leaders, and private citizens across the continent.
Nigeria is not alone in this cyber threat. Recall that on May 19, TechMedia Africa reported that South Africa’s internet infrastructure was hit by a massive distributed denial-of-service (DDoS) attack, disrupting web hosting, e-mail and customer management services across some of the country’s largest network and hosting providers.
A wake-up call for the next generation
For the young, upcoming cybersecurity analysts, ethical hackers, and SOC engineers in Nigeria, the GRIDTIDE campaign is a masterclass in modern threat hunting. It teaches us a vital lesson:
You cannot solely rely on blocking ‘’bad’’ IPs or domains anymore.
The bad guys are now using the exact same trusted platforms we use for our daily work—Google Workspace, Microsoft 365, Slack, and AWS.
To catch the next UNC2814, you have to look beyond the surface. You must analyze behavior. A backend database server that handles voip
call routing has no business communicating with Google Sheets at 2:00 AM, no matter how ‘’trusted’’ the Google URL is.
The future of African cybersecurity won’t just belong to those who know how to configure firewalls; it will belong to those who can spot the wolf dressed in sheep’s clothing, hiding in plain sight on a shared spreadsheet.