Home > List all groups > Gallium

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link APT group: Gallium

NamesGallium (Microsoft)
CountryChina China
MotivationInformation theft and espionage
First seen2018
Description(Microsoft) To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss. Once persistence is established in a network, GALLIUM uses common techniques and tools like Mimikatz to obtain credentials that allows for lateral movement across the target network. Within compromised networks, GALLIUM makes no attempt to obfuscate their intent and are known to use common versions of malware and publicly available toolkits with small modifications. The operators rely on low cost and easy to replace infrastructure that consists of dynamic-DNS domains and regularly reused hop points.

This activity from GALLIUM has been identified predominantly through 2018 to mid-2019. GALLIUM is still active; however, activity levels have dropped when compared to what was previously observed.
ObservedSectors: Telecommunications.
Tools usedBlackMould, China Chopper, HTran, nbtscan, netcat, Mimikatz, Poison Ivy, PsExec, QuarkBandit, SoftEther VPN, Windows Credentials Editor, WinRAR.

Last change to this card: 13 April 2020

Download this actor card in PDF or JSON format

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
PGP Download PGP key