Log in Request a demo

APT Groups

GALLIUM APT: What MITRE ATT&CK Says

GALLIUM is a cyberespionage group MITRE ATT&CK says has been active since at least 2012. See what MITRE confirms, what is unproven and how to defend.

Brandefense logo Updated 3 Min Read
GALLIUM APT group profile showing China-linked cyber espionage targeting telecom and government networks

GALLIUM is a cyberespionage group that MITRE ATT&CK says has been active since at least 2012. It mainly targets telecommunications companies, and also financial institutions and government entities. This post sticks to what the MITRE group page states and says plainly where public sources go no further.

GALLIUM at a glance
Other name.
Granite Typhoon (the only alias MITRE lists).
Active since.
At least 2012.
Main targets.
Telecommunications companies, financial institutions, government entities.
Attribution.
Security researchers call it likely Chinese state-sponsored (MITRE reports this, it does not assess it).
Linked operation.
Operation Soft Cell, a long-term campaign against telecom providers.

What does MITRE ATT&CK say about GALLIUM?

MITRE describes GALLIUM as a cyberespionage group active since at least 2012. It lists targets in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia and Vietnam. It links the group to Operation Soft Cell, a long-term campaign against telecommunications providers.

On attribution, MITRE writes that security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and techniques commonly associated with Chinese threat actors. That is the researchers’ view as reported by MITRE. We found no government advisory that names GALLIUM or Granite Typhoon.

Warning: No government confirmation foundMITRE reports the state-sponsored view but does not make that assessment itself. Names such as Alloy Taurus and Red Giant 4 are not MITRE aliases, so this post does not use them. Dates, regions and victims for Operation Soft Cell are not given by MITRE or by the government sources we checked.

Which techniques does MITRE list for GALLIUM?

MITRE lists the following behavior, each taken from its group page:

Techniques MITRE lists
  1. Get inExploited public-facing servers, including Wildfly and JBoss servers, and used VPN services such as SoftEther VPN to access and keep a foothold.
  2. Run commandsUsed PowerShell and the Windows command shell, including for lateral movement.
  3. Keep accessCreated high-privileged domain accounts to maintain access.
  4. Take credentialsDumped credentials from LSASS memory and password hashes from the SAM registry hive.
  5. Move data outCompressed and encrypted stolen data with WinRAR, staged it in multi-part archives, and exfiltrated it over its command channel using web shells and HTRAN.

MITRE also lists PlugX and PoisonIvy among the software used. It does not describe how each tool was used here, so this post does not either.

What is not confirmed?

Many details found in earlier write-ups of this group rest on vendor reports that this post does not cite. We removed them because no MITRE page or government source supports them. That covers claimed 2023 to 2025 activity, motives beyond espionage, links to other groups, and further malware families and tools. If a government source later names the group, this page can be extended.

How can defenders reduce the risk?

Actions that match the listed techniques
  1. Patch exposed serversKeep internet-facing servers, such as application servers, patched and monitored.
  2. Watch for VPN softwareAlert on VPN clients and services, such as SoftEther, that nobody approved.
  3. Monitor scriptingLog PowerShell and command shell use, especially on servers.
  4. Protect credentialsWatch for access to LSASS memory and the SAM hive, and review new high-privileged domain accounts.
  5. Watch outbound dataLook for large archives staged on servers and unusual outbound transfers.
A smartwatch displaying a Brandefense cyber threat alert, showcasing real-time security notifications for instant response.
Brandefense real-time threat notifications delivered directly to your device.

Frequently Asked Questions.

What is GALLIUM?

GALLIUM is a cyberespionage group active since at least 2012. MITRE ATT&CK describes it as primarily targeting telecommunications companies, financial institutions and government entities.

Is GALLIUM a Chinese state-sponsored group?

MITRE ATT&CK reports that security researchers identified it as a likely Chinese state-sponsored group, based in part on tools and techniques. MITRE does not make that assessment itself, and we found no government source that confirms it.

What other names does GALLIUM have?

MITRE ATT&CK lists only Granite Typhoon. Alloy Taurus and Red Giant 4 are not MITRE aliases.

What was Operation Soft Cell?

A long-term campaign against telecommunications providers that MITRE ATT&CK links to GALLIUM. MITRE gives no dates or regions for it, and neither does this post.

How can organizations defend against GALLIUM?

Patch and monitor internet-facing servers, alert on unapproved VPN software such as SoftEther, log PowerShell use, watch for credential dumping, and look for large staged archives and unusual outbound transfers.

Sources

  1. 1 MITRE ATT&CK: GALLIUM, Granite Typhoon, Group G0093
  2. 2 MITRE ATT&CK: OS Credential Dumping, LSASS Memory (T1003.001)
#brand protection #ciso guide #cyber resilience #cybersecurity #drps #executive people #exposure management #fraud monitoring #security awareness #software supply chain #supply chain #supply chain management #trends
Share

In This Article

Malware and toolsPlugX Malware and toolsPoisonIvy TechniquesServer Software Component: Web Shell (T1505.003) TermsCyber espionage TermsThreat actor TermsLateral movement TermsActive Directory

Where To Next.

All APT Groups Articles
In plain words · Glossary term Cyber espionage

Cyber espionage is the use of computer networks to secretly gather information that someone wants to keep private.

Open → Keep reading · Article Angry Likho: Inside a Rapidly Growing Espionage Threat Targeting Eastern Europe

Angry Likho is a spear-phishing espionage group also tracked as Sticky Werewolf.

Open → Keep reading · Article TraderTraitor: North Korea’s Crypto Heist Machine

TraderTraitor profile (Jade Sleet, UNC4899): North Korea-aligned, part of Lazarus, with crypto theft, trojanized developer tools and supply chain abuse.

Open →

Knowledge HubThreat group profiles brand protectionciso guidecyber resilience