GALLIUM
GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers. Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.
- ATT&CK ID
- G0093
- Origin
- China
- Weather family
- Typhoon
- Techniques
- 27
- Tools
- 16
Also tracked as Granite Typhoon
Techniques
Resource Development
Acquire InfrastructureObtain Capabilities
Initial Access
Valid AccountsExternal Remote ServicesExploit Public-Facing Application
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterHijack Execution Flow
Persistence
Scheduled Task/JobValid AccountsExternal Remote ServicesCreate AccountServer Software Component
Privilege Escalation
Scheduled Task/JobValid Accounts
Stealth
Obfuscated Files or InformationMasqueradingValid AccountsHijack Execution Flow
Defense Impairment
Credential Access
Discovery
System Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoverySystem Network Connections Discovery
Lateral Movement
Use Alternate Authentication MaterialLateral Tool Transfer
Collection
Data from Local SystemData StagedArchive Collected Data
Command and Control
Exfiltration
Software
BlackMould · China Chopper · HTRAN · Mimikatz · NBTscan · Net · Ping · PingPull · PlugX · PoisonIvy · PsExec · Reg · Windows Credential Editor · at · cmd · ipconfig