Google said it has disrupted a Chinese-linked hacking operation that compromised at least 53 organisations across 42 countries, after investigators found the group using Google Cloud services and Google Sheets to blend malicious activity into normal internet traffic.

The threat actor, tracked by Google as UNC2814 and also known as ‘Gallium’, has spent nearly a decade targeting government agencies and telecommunications providers, according to findings from Google’s Threat Intelligence Group shared with Reuters.

“This was a vast surveillance apparatus used to spy on people and organisations throughout the world,” said Google Threat Intelligence Group chief analyst John Hultquist.

Google said it worked with unnamed partners to terminate Google Cloud projects controlled by the hackers, disable the internet infrastructure used in the campaign, as well as shut down accounts that accessed Google Sheets as part of the group’s command-and-control and data theft operations.

Google stressed the misuse of Sheets was not the result of a vulnerability or compromise in Google products. Instead, attackers used legitimate access to evade detection and make their communications look like normal network traffic.

Senior manager Charley Snyder said Google confirmed the group had access to 53 entities, with potential access in at least 22 additional countries at the time of disruption. Google did not name the victims.

In one case, Snyder said the hackers installed a backdoor malware family Google calls ‘GRIDTIDE’ on a system that contained sensitive personal information including full names, phone numbers, dates and places of birth, voter ID and national ID numbers.

Google said the targeting pattern aligns with surveillance campaigns designed to identify and track specific individuals. Similar intrusions have previously been used to steal call data records, monitor SMS messages and even observe targets via telecom “lawful intercept” capabilities.

A spokesperson for China’s embassy, Liu Pengyu, denied wrongdoing, saying cybersecurity should be addressed through international cooperation and that China opposes hacking activities.

Google said the activity is separate from the telecom-focused ‘Salt Typhoon’ campaign that US authorities have linked to China and which targeted hundreds of US organisations and political figures.