GALLIUM - G0093

Created: 2019-07-18T20:47:50.050Z

Modified: 2022-08-12T21:26:22.303Z

Contributors: Daniyal Naeem, BT Security,Cybereason Nocturnus, @nocturnus

Aliases

GALLIUM,Operation Soft Cell

Description

GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)(Citation: Unit 42 PingPull Jun 2022)

Techniques Used

GALLIUM has used Taiwan-based servers that appear to be exclusive to

GALLIUM.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

GALLIUM has used

PsExec to move laterally between hosts in the target network.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

GALLIUM used Web shells and