GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.1 Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.234
- Cybereason Soft Cell June 2019
- Cybereason Soft Cell June 2019
- Microsoft GALLIUM December 2019
- Unit 42 PingPull Jun 2022
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1059.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.004 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1027 | Obfuscated Files or Information | — |
| T1027.002 | Software Packing | — |
| T1027.005 | Indicator Removal from Tools | — |
| T1033 | System Owner/User Discovery | — |
| T1036.003 | Rename Legitimate Utilities | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1074.001 | Local Data Staging | — |
| T1078 | Valid Accounts | — |
| T1090.002 | External Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1133 | External Remote Services | — |
| T1136.002 | Domain Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1505.003 | Web Shell | — |
| T1550.002 | Pass the Hash | — |
| T1553.002 | Code Signing | — |
| T1560.001 | Archive via Utility | — |
| T1570 | Lateral Tool Transfer | — |
| T1574.001 | DLL | — |
| T1583.004 | Server | — |
| T1588.002 | Tool | — |
别名
GALLIUM · Granite Typhoon
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。