Loading malware…
PingPull is a remote access trojan used by the China-linked cyberespionage group GALLIUM, also known as Alloy Taurus and Softcell. Samples date to at least September 2021, and the malware was publicly identified in June 2022. It targets Windows and Linux systems and is associated with espionage operations against telecommunications companies, government entities, and financial institutions. A Linux variant was identified in 2023.
PingPull supports remote command execution, file operations, file and directory discovery, system and network discovery, local data collection, and exfiltration through its command-and-control channel. Variants communicate using ICMP, TCP, or HTTPS, including HTTPS on non-standard ports. Communications can use Base64 encoding and AES encryption; the Linux variant shares encryption and command-structure characteristics with the Windows variant. The Windows version can install itself as a service for persistence and disguise its service as legitimate. PingPull also supports timestomping to obscure file activity and hinder forensic analysis.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
PingPull variants have the ability to communicate with C2 servers using ICMP or TCP.
Unit 42 recently identified a new, difficult-to-detect remote access trojan named PingPull being used by GALLIUM, an advanced persistent threat (APT) group.
After a brief hiatus, the Alloy Taurus APT (aka Gallium or Operation Soft Cell) is back on the scene, with a new Linux variant of its PingPull malware.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
M Run command
[PingPull](https://attack.mitre.org/software/S1031) can use `cmd.exe` to run various commands as a reverse shell.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) has the ability to install itself as a service.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) has the ability to install itself as a service.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`, and `Onedrive` to evade detection.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) has the ability to timestomp a file.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) can decrypt received data from its C2 server by using AES.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) can retrieve the IP address of a compromised host.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) can retrieve the hostname of a compromised host.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) can enumerate storage volumes and folder contents of a compromised host.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) can collect data from a compromised host.(Citation: Unit 42 PingPull Jun 2022)
A [PingPull](https://attack.mitre.org/software/S1031) variant can communicate with its C2 servers by using HTTPS.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) variants have the ability to communicate with C2 servers using ICMP or TCP.(Citation: Unit 42 PingPull Jun 2022)
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.
[PingPull](https://attack.mitre.org/software/S1031) can encode C2 traffic with Base64.(Citation: Unit 42 PingPull Jun 2022)
4H RAT has the capability to create a remote shell. AuditCred can open a reverse shell on the system to execute commands. PlugX allows actors to spawn a reverse shell on a victim. QuasarRAT can launch a remote shell to execute commands on the victim’s machine.
[PingPull](https://attack.mitre.org/software/S1031) can use HTTPS over port 8080 for C2.(Citation: Unit 42 PingPull Jun 2022)
The payload then expects the C2 server to respond with data that is Base64 encoded ciphertext, encrypted with AES using P29456789A1234sS as the key.
[PingPull](https://attack.mitre.org/software/S1031) can use AES, in cipher block chaining (CBC) mode padded with PKCS5, to encrypt C2 server communications.(Citation: Unit 42 PingPull Jun 2022)
[PingPull](https://attack.mitre.org/software/S1031) has the ability to exfiltrate stolen victim data through its C2 channel.(Citation: Unit 42 PingPull Jun 2022)
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.