- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, Tianjin bureau of the Chinese Ministry of State Security, Huaying Haitai
- Motivation
- Information theft and espionage
- Seen
- 2006–2026
- Status
- Active
- ATT&CK
- G0093 · 31 techniques
- Sources
- 13 sources carry it
- Identifier
- GINC-APT-0014 · gallium
ChinaWhat it is
GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers. Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Stone Panda, Phantom Panda
- IBM X-Force
- ITG01
- Mandiant
- APT 10
- Microsoft
- Granite Typhoon, Purple Typhoon
- MITRE ATT&CK
- G0093
- Proofpoint
- TA429
- PwC
- Red Apollo, Red Dev 4, Red Moros
- Secureworks
- CTG-5938
- Trend Micro
- Earth Kasha
- Operations
- Operation Soft Cell, Operation “A41APT”, Operation “Cache Panda”, Operation “ChessMaster”, Operation “Cloud Hopper”, Operation “Cuckoo Spear”, Operation “New Battle”, Operation “Soft Cell”, Operation “TradeSecret”
- Other names
- Alloy Taurus, ATK 41, Bronze Riverside, Cicada, Cuckoo Spear, CVNX, Granite Taurus, Granite Typhoon (Microsoft), Happyyongzi, Hogfish, menuPass, menuPass Team, Othorene, Phantom Panda (CrowdStrike), Potassium, Soft Cell, Stone Panda, APT 10, menuPass, UNSC 2814
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Australia, Belgium, Brazil, Canada, China, Finland, France, Germany, Hong Kong, India, Israel, Italy, Japan, Montenegro, Netherlands, Norway, Philippines, Singapore, South Africa, South Korea, Sweden, Switzerland, Taiwan, Thailand, Türkiye, United Arab Emirates, United Kingdom, United States, Vietnam
- Sectors
- Aerospace, Defense, Energy, Financial, Government, Healthcare, High-Tech, IT, Media, NGOs, Pharmaceutical, Telecommunications
Tools
The tools and malware families the sources tie to it.
- BlackMould
- China Chopper
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- Gh0stCringe RAT
- HTRAN
- Htran
- LaZagne
- Mimikatz
- NBTScan
- NBTscan
- Net
- Netcat
- Ping
- PingPull
- Plink
- PlugX
- PoisonIvy
- PsExec
- QuarkBandit
- QuasarRAT
- Reg
- Reshell
- SoftEther VPN
- Sword2033
- Windows Credential Editor
- Windows Credentials Editor
- Winrar
- Xploit
- at
- cmd
- ipconfig
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de