GALLIUM
Also known as Red Dev 4, Alloy Taurus, Granite Typhoon, PHANTOM PANDA
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
GALLIUM, is a threat actor believed to be targeting telecommunication providers over the world, mostly South-East Asia, Europe and Africa. To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1003.001 LSASS MemoryT1003.002 Security Account ManagerT1005 Data from Local SystemT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1027 Obfuscated Files or InformationT1027.002 Software PackingT1027.005 Indicator Removal from ToolsT1033 System Owner/User DiscoveryT1036.003 Rename Legitimate UtilitiesT1041 Exfiltration Over C2 ChannelT1047 Windows Management InstrumentationT1049 System Network Connections DiscoveryT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1074.001 Local Data StagingT1078 Valid AccountsT1090.002 External ProxyT1105 Ingress Tool TransferT1133 External Remote ServicesT1136.002 Domain AccountT1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1550.002 Pass the HashT1553.002 Code SigningT1560.001 Archive via UtilityT1570 Lateral Tool TransferT1574.001 DLLT1583.004 ServerT1588.002 Tool
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
- https://www.youtube.com/watch?v=fBFm2fiEPTg
- https://troopers.de/troopers22/talks/7cv8pz/
- https://unit42.paloaltonetworks.com/atoms/alloytaurus/
- https://unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government/
- https://attack.mitre.org/groups/G0093
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
- https://unit42.paloaltonetworks.com/pingpull-gallium/
- https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.