G0093: GALLIUM
GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.[1] Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.[1][2][3]
Analyst context for executives and security teams
GALLIUM, also tracked as Granite Typhoon, matters because MITRE describes it as a long-running cyberespionage group focused on telecommunications, financial institutions, and government entities, with Operation Soft Cell specifically targeting telecom providers. For leaders, the practical issue is not only malware blocking; it is whether identity, Windows administration paths, web server exposure, and internal reconnaissance telemetry are strong enough to detect a patient intrusion before sensitive access or data collection expands.
Executive priority
Prioritize this as an intelligence-driven readiness scenario for organizations in or connected to telecom, finance, and government operations, especially where compromise could affect customer data, lawful-intercept-adjacent infrastructure, national services, or partner trust. Executives should ask whether incident response can rapidly validate credential theft, web shell activity, remote administration misuse, and lateral discovery across critical Windows and server environments, and whether audit evidence proves those controls are monitored rather than merely deployed.
Technical view
ATT&CK does not provide a GALLIUM-specific detection section, so coverage should be validated through the related software and techniques. The relationship set is Windows-heavy and includes credential dumping tools such as Mimikatz and Windows Credential Editor, RATs such as PoisonIvy, PlugX, and PingPull, web shells such as China Chopper and BlackMould for IIS, administrative utilities such as PsExec, Net, Reg, cmd, at, Ping, ipconfig, and NBTscan, plus techniques for LSASS/SAM credential access, local data collection, network and remote system discovery, and obfuscation/packing. SOC teams should test whether these behaviors are visible together as an intrusion pattern, not only as isolated tool signatures.
Likely telemetry
- Windows endpoint process creation and command-line logs for cmd, net, reg, at, ipconfig, ping, PsExec-like execution, and credential tooling
- Endpoint security or EDR events for LSASS access, memory dumping behavior, SAM/Registry access, and suspicious credential material handling
- Windows authentication, service creation, remote execution, and administrative share activity useful for validating lateral movement context
- Web server and IIS logs, file integrity monitoring, and server-side script creation/modification evidence for China Chopper- or BlackMould-like web shell activity
- Network telemetry for internal scanning, NBTscan-style discovery, unusual host-to-host connections, proxying behavior, and RAT command-and-control patterns
Detection direction
- Validate detections against behaviors named in the relationships, especially credential access via LSASS and SAM, web shell persistence on IIS/web servers, internal discovery, and remote administration misuse.
- Tune carefully for dual-use tools. PsExec, Net, Reg, cmd, at, ping, ipconfig, and NBTscan can be legitimate, so detections should combine user context, host role, command line, parent process, timing, remote source, and sequence of activity.
- Do not rely only on static malware signatures. The related techniques include obfuscation, software packing, and indicator removal, which make behavior, memory, and execution-context telemetry important.
- Correlate web server anomalies with downstream Windows activity. A web shell relationship is more material when followed by command execution, credential dumping, discovery, or remote access tooling.
- Assess blind spots in critical telecom, finance, and government-facing infrastructure: unmanaged servers, weak IIS logging, incomplete command-line capture, limited east-west network visibility, and insufficient retention for long-running investigations.
Mitigation priorities
- Start with identity hardening: reduce standing administrative privileges, protect privileged sessions, and ensure rapid investigation paths for LSASS/SAM credential access indicators.
- Harden and monitor exposed web servers, especially IIS where relevant, with file integrity monitoring, least privilege for service accounts, and timely review of unexpected server-side scripts or command execution.
- Constrain administrative tooling by policy and monitoring rather than assuming it is benign; require justification and alerting for remote execution, service creation, and unusual command-line administration.
- Improve endpoint and server telemetry collection before incident response is needed, including command line, process ancestry, authentication, registry, memory-access, and web logs with sufficient retention.
- Use threat intelligence to drive scoped hunting for the named tools and behaviors, but validate findings against local baselines to reduce false positives from legitimate administration.
Analyst notes and limits
This take is based on MITRE ATT&CK G0093 version 4.0 and the supplied relationships. The strongest decision value comes from the combination of target-sector context, long-running espionage framing, and related tooling that emphasizes credential theft, remote access, web shells, discovery, and Windows administration misuse. Researcher attribution is described by MITRE as likely Chinese state-sponsored; it should be treated as intelligence context, not as proof for any local incident.
MITRE provides no official detection text, no platforms or tactics on the group object itself, and the supplied relationship snippets do not include full procedure examples. Local exposure, active targeting, control effectiveness, and detection coverage cannot be inferred from ATT&CK alone and require environment-specific telemetry, baselines, and investigation results.
GALLIUM
GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.[1] Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.[1][2][3]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
Groups, software, and campaigns
S0100: ipconfig
S0097: Ping
S0106: cmd
cmd is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. [1]
Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., dir [2]), deleting files (e.g., del [3]), and copying files (e.g., copy [4]).
S0020: China Chopper
S0012: PoisonIvy
S0110: at
S0013: PlugX
S1031: PingPull
PingPull is a remote access Trojan (RAT) written in Visual C++ that has been used by GALLIUM since at least June 2022. PingPull has been used to target telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam.[1]
S0564: BlackMould
BlackMould is a web shell based on China Chopper for servers running Microsoft IIS. First reported in December 2019, it has been used in malicious campaigns by GALLIUM against telecommunication providers.[1]
S0002: Mimikatz
S0039: Net
The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]
Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.
S0075: Reg
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 4.0 | Current bundle | f7f0b61608b5… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Cybereason Soft Cell June 2019
Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
Open source URL -
[2]
Microsoft GALLIUM December 2019
MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.
Open source URL -
[3]
Unit 42 PingPull Jun 2022
Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.
Open source URL -
[4]
GALLIUM
(Citation: Microsoft GALLIUM December 2019)
-
[5]
Granite Typhoon
(Citation: Microsoft Threat Actor Naming July 2023)
-
[6]
Microsoft Threat Actor Naming July 2023
Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Open source URL -
[7]
mitre-attack G0093Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.