GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.56
group
GALLIUM G0093
- Created
- 18 July 2019
- Last modified
- 31 July 2026
- Aliases
- GALLIUM · Granite Typhoon
GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.[1] Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.[1][2][3]
31
Techniques68th pct
13
TacticsTop 15%
16
Tools & malwareTop 10%
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference G0093
GALLIUM used reg commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.7
GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.8
GALLIUM used ipconfig /all to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers.9
GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as ping to identify remote systems.10
GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.11
Standing G0093
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques3168th pct
68th percentile · 68% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
Tactics13Top 15%
85th percentile · 85% of 176 ATT&CK groups have this many tactics spanned or fewer.
Tools & malware16Top 10%
90th percentile · 90% of 176 ATT&CK groups have this many tools and malware or fewer.
Campaigns089% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique36medTop 12%
88th percentile · 88% of 176 ATT&CK groups have this many detection rules per technique or fewer.
Tests / technique5med
Detection coverage G0093
1458 distinct rules cover the 31 techniques recorded for this group. The 1746 technique-to-rule mappings resolve to 1458 distinct rules, because one rule can cover several techniques. 1024 Sigma · 434 Splunk.
30 covered by at least one rule1 with no coverage1458 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org