File · GALLIUM · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 31 techniques across 12 tactics
Analyst brief
misp-galaxy + mitre-attackGALLIUM, is a threat actor believed to be targeting telecommunication providers over the world, mostly South-East Asia, Europe and Africa. To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss.
Kill chain
MITRE ATT&CK Enterprise · tap a technique31 techniques · 12 of 15 tactics
Resource development
2 techniquesInitial access
1 techniqueExecution
4 techniquesPersistence
3 techniquesStealth
6 techniquesDefense impairment
1 techniqueCredential access
2 techniquesDiscovery
4 techniquesLateral movement
2 techniquesCollection
3 techniquesCommand and control
2 techniquesExfiltration
1 technique
select a technique
Arsenal
5 malware · 11 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Take it with you
keyless · no signupReferences
9 sources- 1.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-tele…
- 2.youtube.com/watch?v=fBFm2fiEPTg
- 3.troopers.de/troopers22/talks/7cv8pz
- 4.unit42.paloaltonetworks.com/atoms/alloytaurus
- 5.unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government
- 6.attack.mitre.org/groups/G0093
- 7.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-…
- 8.learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-th…
- 9.unit42.paloaltonetworks.com/pingpull-gallium
Track GALLIUM on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.