← All Threat Actors
Threat Actor Profile

GALLIUM

Alloy Taurus G0093 Granite Typhoon PHANTOM PANDA Red Dev 4
▲ High Threat
GALLIUM, is a threat actor believed to be targeting telecommunication providers over the world, mostly South-East Asia, Europe and Africa. To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss.
Origin China

Known TTPs

Windows Command Shell
Security Account Manager
Valid Accounts
Scheduled Task
Obfuscated Files or Information
Code Signing
Exfiltration Over C2 Channel
Data from Local System
DLL
Tool
Windows Management Instrumentation
Domain Account
Server
External Remote Services
Software Packing
Web Shell
LSASS Memory
Archive via Utility
PowerShell
Lateral Tool Transfer
Indicator Removal from Tools
External Proxy
System Network Connections Discovery
Local Data Staging
System Owner/User Discovery
Exploit Public-Facing Application
System Network Configuration Discovery
Ingress Tool Transfer
Remote System Discovery
Pass the Hash
Rename Legitimate Utilities

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD