GALLIUM

Origin🇨🇳 China

Techniques (MITRE ATT&CK)31

SourceMITRE ATT&CK

Also known as:Granite Typhoon

Vexday analysis

Grupo de ciberespionagem de origem chinesa, ativo desde pelo menos 2012, o GALLIUM (também rastreado como Granite Typhoon, identificador MITRE ATT&CK G0093) tem como alvos principais empresas de telecomunicações, instituições financeiras e entidades governamentais em países como Afeganistão, Austrália, Bélgica, Camboja, Malásia, Moçambique, Filipinas, Rússia e Vietnã. O grupo é especialmente associado à Operação Soft Cell, uma campanha de longa duração direcionada a provedores de telecomunicações. Pesquisadores de segurança o classificam como um provável grupo patrocinado pelo Estado chinês, com base nas ferramentas e nas TTPs empregadas, características comuns a agentes de ameaça desse país. Seu perfil técnico compreende 31 técnicas documentadas no MITRE ATT&CK e 2 CVEs atribuídas ao grupo.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity62

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 31

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Server Tool

Initial access

Exploit Public-Facing Application

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell

Persistence

External Remote Services Domain Account Web Shell

Credential access

LSASS Memory Security Account Manager

Discovery

System Network Configuration Discovery Remote System Discovery System Owner/User Discovery System Network Connections Discovery

Lateral movement

Pass the Hash Lateral Tool Transfer

Collection

Data from Local System Local Data Staging Archive via Utility

Command and control

External Proxy Ingress Tool Transfer

Exfiltration

Exfiltration Over C2 Channel

defense-impairment

Code Signing

stealth

Obfuscated Files or Information Software Packing Indicator Removal from Tools Rename Legitimate Utilities Valid Accounts DLL

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV CVE-2016-6662EPSS 68%

References

GALLIUM uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →