GALLIUM
GALLIUM, also known as Granite Typhoon, Alloy Taurus, and Phantom Panda, is a China-based threat actor. The provided content states that it has compromised telecommunications entities globally, and that reporting also describes expanded targeting across the telecommunications, government, and finance sectors. Palo Alto attributed a cluster using RESHELL malware to GALLIUM with moderate confidence, and Unit 42 identified a new tool named PingPull in connection with the actor. The content describes GALLIUM tradecraft including use of web shells and a modified version of HTRAN for command and control and data exfiltration, including redirecting connections between networks and obfuscating strings in HTRAN to evade detection. It has used Windows command shell, PowerShell, and WMI for execution, lateral movement, and tool deployment across multiple assets. It established persistence for PoisonIvy by creating a scheduled task. Discovery activity included ipconfig /all, whoami, query user, ping, and a modified NBTscan to identify victim network configuration, available NetBIOS name servers, remote systems, and victim user information. For collection and staging, GALLIUM collected local system data including password hashes from the SAM hive in the Registry, and compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration. The actor has also used a variety of widely available tools, in some cases modified to add functionality or subvert antimalware solutions, and has used stolen certificates, including certificates from Whizzimo LLC, to sign its tools. The content also notes associations with China-aligned actors in the context of tradecraft such as protocol tunneling and abuse of external remote services, including use of tools such as SoftEther VPN to maintain persistence and evade detection.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Telecommunication Services
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
47 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
18 malware families attributed to this actor across reporting.
13 additional families tracked in Mallory.
Associated vulnerabilities
8 CVEs this actor has used in observed campaigns. 8 of them exploited in the wild.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence... This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise.
3 more CVEs tied to this actor tracked in Mallory.
Observables
74 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linked in the content to use of CDN-based traffic concealment techniques and SoftEther VPN to maintain persistence and evade detection.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
Listed as a threat actor associated with Azure Active Directory account takeover, persistence, privilege escalation, and related cloud-focused post-compromise activity detected via PowerShell module installation.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.