Google Threat Intelligence Group

Google Threat Intelligence Group (GTIG) is the combined threat-intelligence division of Google, incorporating the Mandiant team acquired by Google in 2022 for approximately $5.4 billion. In May 2026, GTIG disclosed that North Korea-nexus actor UNC1069 had compromised the Axios npm package maintainer on 31 March 2026, planting the WAVESHAPER.V2 backdoor in package versions with a combined 183 million weekly downloads.

GTIG conducts original threat research, manages Google's own threat-intelligence pipeline, and publishes attribution of state-sponsored campaigns. The Mandiant heritage gives the group deep incident-response expertise and one of the longest-running nation-state tracking programmes in the industry; UNC designations ("Uncategorised") are Mandiant's naming convention for clusters that have not yet met the threshold for full APT attribution. UNC1069 is assessed as North Korea-nexus but has not received a confirmed APT number.

The GTIG disclosure — 35 days after the injection — came through coordinated disclosure with npm maintainers and Microsoft (via GitHub's npm infrastructure). GTIG's role as both a government threat-intelligence contractor and a commercial entity operating major internet infrastructure (Google Search, Gmail, Chrome) gives it unusual access to supply-chain telemetry that purely commercial security vendors cannot replicate.