GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.1 Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.234
- Cybereason Soft Cell June 2019
- Cybereason Soft Cell June 2019
- Microsoft GALLIUM December 2019
- Unit 42 PingPull Jun 2022
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1059.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.002 | Software Packing | — |
| T1027.005 | Indicator Removal from Tools | — |
| T1033 | System Owner/User Discovery | — |
| T1036.003 | Rename Legitimate Utilities | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1074.001 | Local Data Staging | — |
| T1078 | Valid Accounts | — |
| T1090.002 | External Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1133 | External Remote Services | — |
| T1136.002 | Domain Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1505.003 | Web Shell | — |
| T1550.002 | Pass the Hash | — |
| T1553.002 | Code Signing | — |
| T1560.001 | Archive via Utility | — |
| T1570 | Lateral Tool Transfer | — |
| T1574.001 | DLL | — |
| T1583.004 | Server | — |
| T1588.002 | Tool | — |
Aliases
GALLIUM · Granite Typhoon
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.