GALLIUM

Threat actor

Attributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.

Names and who uses them

GALLIUMOur name
Granite TyphoonMicrosoft

Targets

Sectors: Government, Finance, Telecommunications

Regions: Australia, Vietnam

Source: MITRE ATT&CK

Known techniques

T1003.001LSASS Memory
T1003.002Security Account Manager
T1005Data from Local System
T1016System Network Configuration Discovery
T1018Remote System Discovery
T1027Obfuscated Files or Information
T1027.002Software Packing
T1027.005Indicator Removal from Tools
T1033System Owner/User Discovery
T1036.003Rename Legitimate Utilities
T1041Exfiltration Over C2 Channel
T1047Windows Management Instrumentation
T1049System Network Connections Discovery
T1053.005Scheduled Task
T1059.001PowerShell
T1059.003Windows Command Shell
T1074.001Local Data Staging
T1078Valid Accounts
T1090.002External Proxy
T1105Ingress Tool Transfer
T1133External Remote Services
T1136.002Domain Account
T1190Exploit Public-Facing Application
T1505.003Web Shell
T1550.002Pass the Hash
T1553.002Code Signing
T1560.001Archive via Utility
T1570Lateral Tool Transfer
T1574.001DLL
T1583.004Server
T1588.002Tool

Source: MITRE ATT&CK

Malware and tools used

at BlackMould China Chopper cmd HTRAN ipconfig Mimikatz NBTscan Net Ping PingPull PlugX PoisonIvy PsExec Reg Windows Credential Editor

Source: MITRE ATT&CK

Recent news

No stories yet.