The Microsoft Threat Intelligence Center (MSTIC) warns of GALLIUM threat group targeting global telecommunication providers worldwide.
The Microsoft Threat Intelligence Center (MSTIC) warns of GALLIUM threat group targeting global
Microsoft experts reported that the GALLIUM hacking group exploits unpatched vulnerabilities to compromise systems running /JBoss application servers.
“Microsoft Threat Intelligence Center (MSTIC) is raising awareness of the ongoing activity by a group we call GALLIUM, targeting telecommunication providers.” reads the warning published by Microsoft. “To compromise targeted networks, GALLIUM target
The GALLIUM threat actor is active, but its activity was more intense between 2018 and mid-2019.
Once the attackers have compromised the target network, they used common techniques and tools like Mimikatz to steal credentials that could be used for lateral movement.
Below the list of tools that were used by the GALLIUM threat actor:
| Tool | Purpose |
| HTRAN | Connection bouncer to proxy connections. |
| Mimikatz | Credential dumper. |
| NBTScan | Scanner for open NETBIOS nameservers on a local or remote TCP/IP network. |
| Netcat | Reads from and writes to network connections using TCP or UDP protocols. |
| PsExec | Executes a command line process on a remote machine. |
| Windows Credential Editor (WCE) | Credential dumper. |
| WinRAR | Archiving utility. |
GALLIUM attackers have signed several tools using stolen code signing certificates.
Experts pointed out that GALLIUM threat actors were using common versions of malware and publicly available tools with a few changes to evade detection. The operators leverage on low cost and easy to replace infrastructure using dynamic-DNS domains and regularly reused hop points.
“MSTIC analysis indicates the use of dynamic DNS providers as opposed to registered domains is in line with GALLIUM’s trend towards low cost and low effort operations.” continues the analysis.
“GALLIUM domains have been observed hosted on infrastructure in mainland China, Hong Kong SAR, and Taiwan.”
The threat actor relies heavily on web shells as a first stage of the attack chain to gain persistence in the target network, then it delivers malware through the existing web shell access.
GALLIUM relies on web shells to gain persistence within a target’s network and to drop their second stage malware payloads instead of first stage installers Microsoft adds.
In addition to standard China Chopper, the group is also using a native web shell for servers running Microsoft IIS dubbed BlackMould.
The group delivers customized versions of Gh0st RAT and Poison Ivy, in both cases, the attackers have modified the communication method used by both malware.
Attackers also used QuarkBandit as a second-stage malware, experts described it as a Gh0st RAT variant with modified configuration options and encryption.
The researchers also observed the GALLIUM threat actors employing SoftEther VPN software to access the target network and maintain persistence.
Microsoft also published a list of indicators of compromise (IOCs) in its report.
The same attack group was previously reported earlier this year by researchers at Cybereason who tracked the campaign as “Operation
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(
[adrotate banner=”5″]
[adrotate banner=”13″]
