GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New Ping Pull Tool
Summary: Unit 42 identified a new remote access trojan called PingPull used by GALLIUM, an APT group assessed as likely Chinese state-sponsored that built its reputation targeting telecommunications companies in Southeast Asia, Europe and Africa. Over the past year GALLIUM extended targeting to financial institutions and government entities, with infrastructure connections identified across Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia and Vietnam, and PingPull uses ICMP, HTTP(S) and raw TCP for command and control.
What's compelling: PingPull's ICMP variant hides C2 traffic in ping packets because few organizations inspect ICMP on their networks, and pivoting on its samples and domains surfaced over 170 IP addresses tied to the group dating back to late 2020.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026