MITRE ATT&CKgroup

G0093 GALLIUM

Published 2019-07-18 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Granite Typhoon
Version
4.0
Created
2019-07-18

Description

GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers. Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.

Related

Uses · MITRE ATT&CK (47)

  • S1031 PingPull software (malware)
  • S0590 NBTscan software (tool)
  • S0564 BlackMould software (malware)
  • T1583.004 Server sub-technique
  • T1588.002 Tool sub-technique
  • T1027.005 Indicator Removal from Tools sub-technique
  • T1090.002 External Proxy sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1574.001 DLL sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1036.003 Rename Legitimate Utilities sub-technique
  • T1027.002 Software Packing sub-technique
  • T1553.002 Code Signing sub-technique
  • T1550.002 Pass the Hash sub-technique
  • T1136.002 Domain Account sub-technique
  • T1505.003 Web Shell sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1190 Exploit Public-Facing Application technique
  • S0002 Mimikatz software (tool)
  • S0005 Windows Credential Editor software (tool)
  • S0012 PoisonIvy software (malware)
  • S0013 PlugX software (malware)
  • S0020 China Chopper software (malware)
  • S0029 PsExec software (tool)
  • S0039 Net software (tool)
Show all 47 ›

References