Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Exposing the Undercurrent: Disrupting the GRIDTIDE Global Cyber Espionage Campaign Introduction Last week, Google Threat Intelligence Group (GTIG), Mandiant, and partners took action to disrupt a global espionage campaign targeting telecommunications and government organizations in dozens of nations across four continents. The threat actor, UNC2814, is a suspected People's Republic of China (PRC)-nexus cyber espionage group that GTIG has tracked since 2017. This prolific, el…

https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign

sha256:c99859f776acd9874063b4aff1f11e39442e5dd6832a89ea6f9d3082a96672cb

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url7
ipv426
ipv60
sha10
domain204
sha2566
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
ip	130.94.6.228	Open →
ip	38.180.205.14	Open →
ip	38.60.194.21	Open →
ip	38.54.112.184	Open →
ip	38.60.171.242	Open →
ip	195.123.211.70	Open →
ip	202.59.10.122

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports