GALLIUM used a modified version of

HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|

GALLIUM used a modified version of

HTRAN to redirect connections between networks.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

GALLIUM packed some payloads using different types of packers, both known and custom.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

GALLIUM established persistence for

PoisonIvy by created a scheduled task.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.003|Rename System Utilities|

GALLIUM used a renamed cmd.exe file to evade detection.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and

HTRAN.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

GALLIUM used

GALLIUM used

GALLIUM used

NBTscan to identify available NetBIOS name servers.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

GALLIUM used a modified version of

Mimikatz along with a PowerShell-based