Google says it has disrupted a Chinese-linked hacking group that infiltrated at least 53 organizations across 42 countries.

The group, tracked as UNC2814 and known as “Gallium,” has spent nearly a decade targeting government agencies and telecommunications companies, according to findings Google shared with Reuters.

John Hultquist, chief analyst at Google’s Threat Intelligence Group, described the operation as a “vast surveillance apparatus” used to spy on individuals and institutions around the world.

Google said it worked with unnamed partners to terminate Google Cloud projects controlled by the hackers, disable internet infrastructure they relied on, and shut down accounts used to access Google Sheets.

Investigators say the group used Google Sheets as a command-and-control tool, allowing its activity to blend into normal network traffic and evade detection. Google emphasized that none of their products were compromised. Instead, legitimate services were abused.

Charley Snyder, senior manager at Google’s Threat Intelligence Group, said the hackers had confirmed access to 53 unnamed entities across 42 countries. At the time of disruption, they may have had potential access in at least 22 additional countries.

In one case, the group installed a backdoor known as “GRIDTIDE” on a system containing full names, phone numbers, birth records, voter identification and national ID numbers.

Google says the activity was consistent with efforts to identify and track specific targets, including possible monitoring of call data and text messages through telecom systems.

The company said the campaign is separate from another China-linked operation known as “Salt Typhoon,” which U.S. officials have tied to attacks on American organizations and political figures.