Malware
GRIDTIDE
According to Google, GRIDTIDE is a sophisticated backdoor written in C and delivered as a Linux ELF binary that provides remote shell command execution, file upload, and file download capabilities.
GRIDTIDE is a Linux malware family operated by UNC2814.
Background
Google describes GRIDTIDE as an advanced C-language backdoor shipped as a Linux ELF binary, offering remote shell command execution along with file upload and download. For command-and-control it abuses a cloud-based spreadsheet service through its official APIs, wrapping all communications in URL-safe Base64 so the traffic resembles ordinary HTTPS. It depends on a separate 16-byte key file to decrypt its cloud configuration with AES-128 in CBC mode, after which it gathers extensive host details (user, host, OS, network, and locale data) and writes that metadata into specific spreadsheet cells. The backdoor maintains persistence via a system service, polls cells to receive tasks and return results, and can park tooling and stolen data in spreadsheet cells to evade conventional network-based detection.
Source: Malpedia (Fraunhofer FKIE).