Home / Threat actors / GALLIUM

GALLIUM G0093

🔔 Create alert

Also known as: Granite Typhoon

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

38

Techniques

16

Malware and tools

GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers. Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development

T1583.004 Server T1588.002 Tool

Initial Access

T1078 Valid Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1574.001 DLL

Persistence

T1053.005 Scheduled Task T1078 Valid Accounts T1133 External Remote Services T1136.002 Domain Account T1505.003 Web Shell

Privilege Escalation

T1053.005 Scheduled Task T1078 Valid Accounts

Stealth

T1027 Obfuscated Files or Information T1027.002 Software Packing T1027.005 Indicator Removal from Tools T1036.003 Rename Legitimate Utilities T1078 Valid Accounts T1574.001 DLL

Defense Impairment

T1553.002 Code Signing

Credential Access

T1003.001 LSASS Memory T1003.002 Security Account Manager

Discovery

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1049 System Network Connections Discovery

Lateral Movement

T1550.002 Pass the Hash T1570 Lateral Tool Transfer

Collection

T1005 Data from Local System T1074.001 Local Data Staging T1560.001 Archive via Utility

Command and Control

T1090.002 External Proxy T1105 Ingress Tool Transfer

Exfiltration

T1041 Exfiltration Over C2 Channel

Malware and tools

BlackMouldMalwareS0564
China ChopperMalwareS0020
PingPullMalwareS1031
PlugXMalwareS0013
PoisonIvyMalwareS0012
atToolS0110
cmdToolS0106
HTRANToolS0040
ipconfigToolS0100
MimikatzToolS0002
NBTscanToolS0590
NetToolS0039
PingToolS0097
PsExecToolS0029
RegToolS0075
Windows Credential EditorToolS0005

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.