Pierluigi Paganini December 12, 2019

The Microsoft Threat Intelligence Center (MSTIC) warns of GALLIUM threat group targeting global telecommunication providers worldwide.

The Microsoft Threat Intelligence Center (MSTIC) warns of GALLIUM threat group targeting global telecommunication providers worldwide.

Microsoft experts reported that the GALLIUM hacking group exploits unpatched vulnerabilities to compromise systems running /JBoss application servers.

“Microsoft Threat Intelligence Center (MSTIC) is raising awareness of the ongoing activity by a group we call GALLIUM, targeting telecommunication providers.” reads the warning published by Microsoft. “To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss.”

The GALLIUM threat actor is active, but its activity was more intense between 2018 and mid-2019.

Once the attackers have compromised the target network, they used common techniques and tools like Mimikatz to steal credentials that could be used for lateral movement.

Below the list of tools that were used by the GALLIUM threat actor:

GALLIUM attackers have signed several tools using stolen code signing certificates.

Experts pointed out that GALLIUM threat actors were using common versions of malware and publicly available tools with a few changes to evade detection. The operators leverage on low cost and easy to replace infrastructure using dynamic-DNS domains and regularly reused hop points.

“MSTIC analysis indicates the use of dynamic DNS providers as opposed to registered domains is in line with GALLIUM’s trend towards low cost and low effort operations.” continues the analysis.

“GALLIUM domains have been observed hosted on infrastructure in mainland China, Hong Kong SAR, and Taiwan.”

The threat actor relies heavily on web shells as a first stage of the attack chain to gain persistence in the target network, then it delivers malware through the existing web shell access.

GALLIUM relies on web shells to gain persistence within a target’s network and to drop their second stage malware payloads instead of first stage installers Microsoft adds.

In addition to standard China Chopper, the group is also using a native web shell for servers running Microsoft IIS dubbed BlackMould.

BlackMould is able to enumerate local drives, employ basic file operations (i.e. find, read, write, delete, and copy), set file attributes, infiltrate files, and run cmd.exe with parameters.

The group delivers customized versions of Gh0st RAT and Poison Ivy, in both cases, the attackers have modified the communication method used by both malware.

Attackers also used QuarkBandit as a second-stage malware, experts described it as a Gh0st RAT variant with modified configuration options and encryption.

The researchers also observed the GALLIUM threat actors employing SoftEther VPN software to access the target network and maintain persistence.

Microsoft also published a list of indicators of compromise (IOCs) in its report.

The same attack group was previously reported earlier this year by researchers at Cybereason who tracked the campaign as “Operation Softcell“.  The analysis published by Cybereason details the nature of the attacks that were discovered by Cybereason in 2018, including the hacking of the telco companies to carry out state-sponsored espionage.  Cybereason found evidence that the attacks date back to 2012.

Pierluigi Paganini

(SecurityAffairs – GALLIUM, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]