GALLIUM

Origin🇨🇳 China

Techniques (MITRE ATT&CK)31

SourceMITRE ATT&CK

Also known as:Alloy TaurusGranite TyphoonPHANTOM PANDARed Dev 4

About the group

GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers. Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity62

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 31

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Server Tool

Initial access

Exploit Public-Facing Application

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell

Persistence

External Remote Services Domain Account Web Shell

Credential access

LSASS Memory Security Account Manager

Discovery

System Network Configuration Discovery Remote System Discovery System Owner/User Discovery System Network Connections Discovery

Lateral movement

Pass the Hash Lateral Tool Transfer

Collection

Data from Local System Local Data Staging Archive via Utility

Command and control

External Proxy Ingress Tool Transfer

Exfiltration

Exfiltration Over C2 Channel

defense-impairment

Code Signing

stealth

Obfuscated Files or Information Software Packing Indicator Removal from Tools Rename Legitimate Utilities Valid Accounts DLL

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

References

GALLIUM uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →