GALLIUM
No sourced public emblem in this profile.
reference profile · reported nexus: CN (not nationality)
GALLIUM, is a threat actor believed to be targeting telecommunication providers over the world, mostly South-East Asia, Europe and Africa. To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss.
Source-reported aliases: Red Dev 4, Alloy Taurus, Granite Typhoon, PHANTOM PANDA. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
https://www.youtube.com/watch?v=fBFm2fiEPTg
https://troopers.de/troopers22/talks/7cv8pz/
https://unit42.paloaltonetworks.com/atoms/alloytaurus/
https://unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government/