GALLIUM

Executive Summary

GALLIUM, also known as Granite Typhoon, Red Dev 4, Alloy Taurus, and PHANTOM PANDA, is a cyberespionage group active since at least 2012. The group primarily targets telecommunications companies, financial institutions, and government entities across Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. GALLIUM is suspected to be a state-sponsored Chinese threat actor based on its tools and tactics, with notable operations such as Operation Soft Cell targeting telecommunications providers.

Goals & Targeting

GALLIUM's strategic objectives appear to be primarily focused on espionage, targeting sectors that hold sensitive information such as telecommunications, finance, and government. The group's targeting profile suggests a focus on countries with significant geopolitical interests or where influence can be maximized through cyberespionage activities. The choice of victims indicates an intent to gather classified information, disrupt critical infrastructure, or gain strategic advantages.

GALLIUM is a persistent cyberespionage group that has been operational since at least 2012, with primary focus on telecommunications companies, financial institutions, and government entities. The group's activities span multiple countries including Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. GALLIUM is known for its long-term campaign Operation Soft Cell, which targeted telecommunications providers. Security researchers have identified the group as likely Chinese state-sponsored, based on tools used and tactics commonly associated with Chinese threat actors. This includes tools such as PingPull, China Chopper, BlackMould, PlugX, and PoisonIvy, which are indicative of a well-resourced and sophisticated adversary.

Key Capabilities

• Spear-phishing campaigns
• Use of custom malware and tools like PingPull, China Chopper, BlackMould, PlugX, PoisonIvy
• Data exfiltration through C2 channels
• Local data staging and external remote services exploitation
• DLL injection and code signing techniques
• Windows Management Instrumentation (WMI) usage

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

GALLIUM is known for Operation Soft Cell, a long-term campaign targeting telecommunications providers. The group employs sophisticated techniques such as scheduled tasks, archive utilities, and external remote services to achieve persistence and data exfiltration. Campaign patterns include initial access via phishing or exploit of public-facing applications, followed by lateral movement within networks using tools like PlugX and PoisonIvy. Recent observations suggest increased focus on Southeast Asian countries, with campaigns extending into 2023.

IOC Patterns

• Spear-phishing emails with malicious attachments
• Scheduled task creation for persistence
• C2 communication channels
• DLL injection
• Use of legitimate utilities for malicious purposes

Recommended Actions

• Implement multi-layered network monitoring to detect C2 activities and scheduled tasks.
• Conduct regular user training to identify spear-phishing attempts.
• Monitor for unauthorized access to sensitive systems using WMI or LSASS memory dumping techniques.
• Apply patches and updates to mitigate known vulnerabilities exploited by the group.
• Use endpoint detection solutions to identify malicious tools like PlugX and China Chopper.

Suggested Tags