GALLIUM
IntrusionSet · ATTACK:enterprise:G0093
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0093",
"title": "GALLIUM",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0093",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--06a11b7e-2a36-47fe-8d3e-82c265df3258",
"external_id": "G0093",
"domain": "enterprise",
"created": "2019-07-18T20:47:50.050Z",
"modified": "2026-07-31T18:47:36.314Z",
"version": "4.0",
"aliases": [
"GALLIUM",
"Granite Typhoon"
],
"tactics": [
],
"source_references": [
{
"source_name": "GALLIUM"
},
{
"source_name": "Granite Typhoon"
},
{
"source_name": "Cybereason Soft Cell June 2019",
"url": "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft GALLIUM December 2019",
"url": "https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"
},
{
"source_name": "Unit 42 PingPull Jun 2022",
"url": "https://unit42.paloaltonetworks.com/pingpull-gallium/"
}
]
}Explicit source assertions (47)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0100
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--058ed2a0-4419-437e-9f3b-4df97f917e8f
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0097
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--090c11ed-8235-4c05-b553-749ee6497b0a
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a20969e-c201-47cd-ac08-8e1a9c764512
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--109c7cc7-fec6-4d86-ae27-087cddb2670c
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15a8c4ba-f86d-4b2f-a0c7-9390d22dbd4e
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1003.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a28a0a2-8e2f-4c42-b6b0-0ffe3d821528
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a849525-ee44-4c28-86b2-fe883c45dc79
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--272c29eb-9f83-4a90-a9b2-e823182204a7
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bff8dad-2ef1-485c-8c0b-62a5ba4c384b
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fc6e8dc-5117-41ea-9b5f-154cff612f6f
Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--380743e5-616c-4524-96e6-d545e5b653ea
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38be247c-74b0-42f3-964e-5f23ef42a353
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b523bd9-ffc2-4525-a08c-4500bfcb2fed
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b86d8fe-5677-4516-bf77-898e4da6171f
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3faaf140-71cd-4cc2-91c9-f0980ca72079
Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--402e9430-9d3a-4694-89ca-923dab3fba26
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1136.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--433ccc4b-5a1f-49e2-9517-f8f899646cab
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1583.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45c9645b-05df-4ec0-9965-293587c3928e
Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e1a2f47-7aad-4402-884d-8921a6a88822
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57b4f42b-02e2-4cee-98f0-d6935c1e2c7b
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b271a21-d91f-489b-b6a1-b223a9094df5
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d8315ce-3c76-4b78-8d6a-f0b7b101bcc0
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S1031
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ee76354-a60b-4c20-b3d8-1adda813f792
Unit 42 PingPull Jun 2022ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--626697e3-0d05-4081-aa11-61280a502249
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0564
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73bcd300-467e-4473-9ba7-772ae1c58610
Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7adea746-109e-41c2-bf48-20e0282038a0
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86246bef-ad4c-4c30-805a-d6f1928a7c20
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8698cc92-79ad-46c4-9cb8-30ef87a8d760
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89697f9e-cfd2-4273-a5d6-04354f0c3e7c
Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f66e226-ecc4-408d-becb-4e9ad9c66b57
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1027.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--919f6143-eb8c-48cd-8741-118040c372ab
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96db4cd3-0493-4944-b47c-15b7db6f0010
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1090.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a084527d-2858-4037-bc48-68c1eac85acb
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a29a37fc-86e2-4b93-8fa5-560b0a395fbc
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a68d8191-b374-4741-a249-1db3515d581b
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa64ee12-ae96-40fe-ba37-a8893cd321ec
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad60e0be-02a4-4f79-a81d-afdde78492be
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0075
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0a6e22f-adad-4625-b07d-996221cf3a50
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b10df154-0c2a-4159-ac0a-1bdaa78f56cb
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3295bb6-356b-4f8e-b921-ec96d249c66b
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b68c8dc2-e3da-4ce8-aef3-456b160e7fb5
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc443415-7c35-49ab-92a9-3d0cfa68c7b2
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1268feb-9326-40e1-b05b-fd8e0068488a
Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea71022e-7f2a-4065-9cb1-304f85dbaf6d
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1550.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee4d1b24-603f-40df-8f21-3c053fba275f
Cybereason Soft Cell June 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee500581-0b91-42ab-bc1f-0a10a3af47c4
Microsoft GALLIUM December 2019ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1036.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8517b42-4d52-417a-a5dc-cbfb2a31930b
Cybereason Soft Cell June 2019