Threat intelligence / Group

GALLIUM

[GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.(Citation: Cybereason Soft Cell June 2019) Security researchers have identified [GALLIUM](https://attack.mitre.org/groups/G0093) as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)(Citation: Unit 42 PingPull Jun 2022)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[GALLIUM](https://attack.mitre.org/groups/G0093) is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.(Citation: Cybereason Soft Cell June 2019) Security researchers have identified [GALLIUM](https://attack.mitre.org/groups/G0093) as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)(Citation: Unit 42 PingPull Jun 2022)

47 recorded

Relationships

uses

to Archive via Utility

Technique

uses

to at

Tool

uses

Malware

uses

to China Chopper

Malware

uses

to cmd

Tool

uses

to Code Signing

Technique

uses

to Data from Local System

Technique

uses

to DLL

Technique

uses

to Domain Account

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to External Proxy

Technique

uses

to External Remote Services

Technique

uses

Tool

uses

to Indicator Removal from Tools

Technique

uses

to Ingress Tool Transfer

Technique

uses

Tool

uses

to Lateral Tool Transfer

Technique

uses

to Local Data Staging

Technique

uses

to LSASS Memory

Technique

uses

Tool

uses

Tool

uses

to Net

Tool

uses

to Obfuscated Files or Information

Technique

uses

to Pass the Hash

Technique

uses

Tool

uses

Malware

uses

Malware

uses

Malware

uses

Technique

uses

Tool

uses

to Reg

Tool

uses

to Remote System Discovery

Technique

uses

to Rename Legitimate Utilities

Technique

uses

to Scheduled Task

Technique

uses

to Security Account Manager

Technique

uses

Technique

uses

to Software Packing

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

Technique

uses

to Valid Accounts

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Credential Editor

Tool

uses

to Windows Management Instrumentation

Technique

7 external

References

mitre-attack

G0093

GALLIUM

—

Granite Typhoon

—

Cybereason Soft Cell June 2019

https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

Microsoft GALLIUM December 2019

https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/

Unit 42 PingPull Jun 2022

https://unit42.paloaltonetworks.com/pingpull-gallium/