GALLIUM

Gallium, also known as Alloy Taurus, is a China-aligned threat actor known for executing actions with malicious intent in the cyber domain. In recent years, Gallium has been associated with various significant cyber-espionage campaigns. The group targeted telecommunication entities in the Middle East during the SoftCell campaign and launched an espionage campaign against an African telecommunications organization between November 2022 and April 2023. Gallium's modus operandi includes leveraging vulnerabilities in network devices and developing custom malware such as BlackMould, a native webshell for servers running Microsoft IIS. In the geopolitical and IT supply chain realm, China made a critical move in 2023 by restricting exports of gallium and germanium, two minerals used in high-performance chips. This tactic not only affects the global chip supply chain but also serves as a countermeasure in the ongoing trade war. In August of the same year, Beijing further tightened its export controls by requiring Chinese exporters of gallium and germanium to obtain government licenses for overseas shipments. The activities of Gallium extend beyond telecommunications operators to include targeting government organizations worldwide, exploiting weaknesses in systems like Microsoft Exchange servers or IIS servers. Other groups associated with China’s People's Liberation Army or government, such as APT27, APT30, APT31, Ke3chang, and Mustang Panda, share similar tactics and targets. Despite the shared toolset among these threat actors, attribution to specific groups remains challenging due to the complex nature of these operations. As Gallium continues its cyber-espionage activities, it poses a significant threat to telecommunications companies, financial institutions, and government entities.