ctrlINT What the industry said about every indicator, with the quote

GALLIUMThreat actor

  • alloy taurus
  • granite typhoon
  • phantom panda
  • red dev 4

GALLIUM, is a threat actor believed to be targeting telecommunication providers over the world, mostly South-East Asia, Europe and Africa. To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss.From MISP Galaxy

Last reported 2 months ago, by AhnLab ASEC1 report

Suspected originChinaMISP Galaxy

ATT&CK techniques

1 technique · each with the sentence it comes from
  1. T1505.003Web Shell

    “…acker used utilities such as PowerShell, bitsadmin, and Certui to install SoftEther VPN and is believed to have ultimately installed a web shell.”

    AhnLab ASECVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “For example, according to a Microsoft report, the GALLIUM threat actor installed a SoftEther VPN server on the Attack Target’s network to gain access to the internal network through it.”

    AhnLab ASECVendor
    Attack Cases for Domestic Web Servers Running SoftEther VPN in Korea

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with GALLIUM here?
No account needed. We do not store your IP address.