GALLIUM

Overview

GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers. Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.

Naming & attribution

GALLIUM is tracked under 2 names across the industry. It uses 31 documented ATT&CK techniques — more than 67% of the 174 groups tracked here. Activity attributed since at least 2012.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• menuPass China — 19 shared techniques (33% overlap)
• APT3 China — 18 shared techniques (32% overlap)
• Wizard Spider Russia — 21 shared techniques (28% overlap)
• Threat Group-3390 China — 19 shared techniques (28% overlap)
• FIN13 — 18 shared techniques (27% overlap)
• APT41 China — 23 shared techniques (26% overlap)

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190
• Custom malware/implant development — ATT&CK: 5 attributed custom malware families

TTPs — 31 techniques across 12 tactics

Tools & malware (16)

ipconfig · Ping · cmd · China Chopper · PoisonIvy · at · PlugX · PingPull · BlackMould · Mimikatz · Net · Reg · PsExec · HTRAN · NBTscan · Windows Credential Editor

Reporting (3)

• How Microsoft names threat actors — Microsoft
• GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool — Unit 42
• GALLIUM: Targeting global telecom — MSTIC