GALLIUM

Summary

Cyber-espionage group active since at least 2012, tracked as GALLIUM / Granite Typhoon by Microsoft, Alloy Taurus by Unit 42, Phantom Panda by CrowdStrike and G0093 by MITRE, and associated with Operation Soft Cell, a long-running campaign against telecommunications providers. Unit 42 calls it a suspected nation-state actor attributed to China, and MITRE says researchers consider it likely Chinese state-sponsored, based on tooling and TTPs. Microsoft observed telecom intrusions mostly from 2018 to mid-2019. Initial access came through exploitation of unpatched internet-facing services such as WildFly/JBoss (T1190), followed by China Chopper and the IIS web shell BlackMould (T1505.003), credential dumping (T1003.001), tools signed with stolen code-signing certificates (T1553.002), SoftEther VPN for persistent access (T1133) and WinRAR staging (T1560.001). Payloads included the modified Gh0st RAT QuarkBandit and Poison Ivy, controlled from Taiwan-based servers exclusive to the group (T1583.004). In 2021–22 it widened from telecoms to financial institutions and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia and Vietnam. That phase introduced PingPull, a RAT using ICMP, HTTP(S) or raw TCP for C2 (T1095) that installs as a service imitating iphlpsvc (T1543.003, T1036.004). In 2023 Unit 42 reported a Linux PingPull variant and the Sword2033 backdoor. A C2 domain impersonated the South African military, and traffic came from a Nepalese infrastructure-finance organisation, which suggests that organisation was compromised.

Attribution

No service publicly named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Likely Chinese state-sponsored
• Palo Alto Networks Unit 42 (Research, 2025-08-01)
  Suspected nation-state group attributed to China

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 10

Malware and tools 4

Infrastructure patterns

• Domains hosted in mainland China, Hong Kong SAR and Taiwan (Microsoft, 2019)
• Cheap, replaceable infrastructure: dynamic-DNS domains and reused hop points (Microsoft, 2019)
• C2 domains impersonating a target country's military (South Africa, Unit 42 2023)

Reporting and advisories 3

• Microsoft
  GALLIUM: Targeting global telecom (Dec 2019)
• Unit 42
  GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool (Jun 2022)
• Unit 42
  Chinese Alloy Taurus Updates PingPull Malware (Apr 2023)