# GALLIUM: threat group profile

> GALLIUM is a threat group thought to operate from China. Public reporting links it to 27 attack techniques. This free profile shows how it works, stage by stage, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/gallium
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > GALLIUM

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 27 (plus 18 sub-techniques) |
| Thought to operate from | China |
| Other names | 3 |
| Public reports | 5 |

## Who is GALLIUM?

GALLIUM is a threat group thought to operate from China. Public reporting links it to 27 attack techniques.

### Also known as

Red Dev 4, Alloy Taurus, Granite Typhoon

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> GALLIUM, is a threat actor believed to be targeting telecommunication providers over the world, mostly South-East Asia, Europe and Africa. To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss.

## How does GALLIUM attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 27 linked to GALLIUM. Some techniques belong to more than one stage. Public reporting also lists 18 more specific variations of them, called sub-techniques.

### 1. Research (0)

- None linked in public reporting.

### 2. Preparation (2)

- T1583: Acquire Infrastructure
- T1588: Obtain Capabilities

### 3. Getting in (3)

- T1078: Valid Accounts
- T1133: External Remote Services
- T1190: Exploit Public-Facing Application

### 4. Running code (4)

- T1047: Windows Management Instrumentation
- T1053: Scheduled Task/Job
- T1059: Command and Scripting Interpreter
- T1574: Hijack Execution Flow

### 5. Staying in (5)

- T1053: Scheduled Task/Job
- T1078: Valid Accounts
- T1133: External Remote Services
- T1136: Create Account
- T1505: Server Software Component

### 6. Taking control (2)

- T1053: Scheduled Task/Job
- T1078: Valid Accounts

### 7. Hiding (4)

- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1078: Valid Accounts
- T1574: Hijack Execution Flow

### 8. Disabling defences (1)

- T1553: Subvert Trust Controls

### 9. Stealing passwords (1)

- T1003: OS Credential Dumping

### 10. Looking around (4)

- T1016: System Network Configuration Discovery
- T1018: Remote System Discovery
- T1033: System Owner/User Discovery
- T1049: System Network Connections Discovery

### 11. Spreading (2)

- T1550: Use Alternate Authentication Material
- T1570: Lateral Tool Transfer

### 12. Gathering data (3)

- T1005: Data from Local System
- T1074: Data Staged
- T1560: Archive Collected Data

### 13. Keeping contact (2)

- T1090: Proxy
- T1105: Ingress Tool Transfer

### 14. Taking data out (1)

- T1041: Exfiltration Over C2 Channel

### 15. Causing damage (0)

- None linked in public reporting.

## Public reports about GALLIUM

- https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
- https://www.youtube.com/watch?v=fBFm2fiEPTg
- https://troopers.de/troopers22/talks/7cv8pz/
- https://unit42.paloaltonetworks.com/atoms/alloytaurus/
- https://unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government/

## Frequently asked questions

### Who is GALLIUM?

GALLIUM is a threat group thought to operate from China. Public reporting links it to 27 attack techniques.

### Where is GALLIUM thought to be based?

Public reporting places GALLIUM as operating from China. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### How does GALLIUM attack?

Public reporting links GALLIUM to 27 attack techniques. Most of them are about staying in, running code and hiding.

### How do I know if GALLIUM is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact