Threat actor

GALLIUM

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 17, 2026 · last 29d ago

Timeline2 articles

Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government

Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.

Unit 42 investigated espionage attacks starting in late 2022 against multiple governmental entities in a Southeast Asian country, including critical infrastructure, public healthcare, financial administrators, and ministries. Analysis revealed three distinct clusters: CL-STA-0044 attributed to Stately Taurus (Mustang Panda), CL-STA-0045 to Alloy Taurus (GALLIUM), and CL-STA-0046 to Gelsemium. The first cluster used a ToneShell backdoor variant, ShadowPad, China Chopper web shells, Impacket, and credential dumping tools across roughly Q1 2021 to Q3 2023. All three operated with distinct tools, infrastructure, and long-term surveillance tradecraft consistent with APTs.

Palo Alto Unit 42Aug 17, 10:57 UTC · 29d agoThreat actor in the wild

Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus

Alloy Taurus (GALLIUM) compromised Southeast Asian government networks from 2022 to 2023 using Exchange web shells and undocumented .NET backdoors Reshell and Zapoa.

Unit 42 tracked persistent multiwave intrusions at a Southeast Asian government starting in early 2022 and continuing through 2023, attributing the activity with moderate confidence to Alloy Taurus (aka GALLIUM), a Chinese state-aligned espionage group. Attackers exploited Exchange Server vulnerabilities to deploy web shells including China Chopper, then ran reconnaissance with Fscan and WebScan, created administrative accounts, and installed undocumented .NET backdoors named Reshell and Zapoa. They established resilience by installing SoftEther VPN, brute-forced Active Directory credentials with Kerbrute, and dumped credential stores with GoDumpLsass and LsassUnhooker. The campaign reflects long-term espionage tradecraft to maintain a foothold.

Palo Alto Unit 42Aug 17, 10:54 UTC · 29d agoThreat actor in the wild1

Appears with

product China Chopper 2 organization Palo Alto Networks 2 organization Unit 42 2 threat actor Alloy Taurus 2 threat actor Stately Taurus 1 malware Reshell 1 malware ShadowPad 1 malware ToneShell 1 malware Zapoa 1 product Exchange Server 1 product Fscan 1 product GoDumpLsass 1 product Impacket 1 product Kerbrute 1 product LsassUnhooker 1 product ShadowPad 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.