Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

TrojanDropper:Win32/BlackMould.A!dha
Trojan:Win32/BlackMould.B!dha
Trojan:Win32/QuarkBandit.A!dha
Trojan:Win32/Sidelod.A!dha

The threat identified as 'GALLIUM: Targeting global telecom' involves a suite of malware tools and trojans primarily targeting telecommunications organizations worldwide. The malware family includes TrojanDropper:Win32/BlackMould variants (A and B), Trojan:Win32/QuarkBandit.A, and Trojan:Win32/Sidelod.A, which are known for their capability to deliver and execute payloads stealthily within compromised systems. The campaign is attributed to the threat actor group known as GALLIUM, which is recognized for sophisticated cyber espionage operations. The tools and malware associated with this threat include well-known post-exploitation and lateral movement utilities such as HTRAN (a proxy tool used to tunnel traffic and obfuscate command and control communications), Mimikatz (credential dumping tool), PsExec (remote execution tool), Windows Credential Editor (for credential manipulation), China Chopper (a lightweight web shell), Poison Ivy (a remote access trojan), Netcat (network utility), and NBTSCan (network scanner). These tools collectively enable attackers to gain initial access, escalate privileges, move laterally within networks, maintain persistence, and exfiltrate sensitive data. The attack methodology likely involves initial compromise via spear-phishing or exploiting vulnerabilities, followed by deployment of these tools to establish control over telecom infrastructure. The campaign's focus on global telecom operators suggests targeting of critical communication infrastructure to conduct espionage, data theft, or potentially disrupt services. Microsoft has acknowledged this threat and released patches addressing vulnerabilities exploited by GALLIUM, emphasizing the importance of timely patching. Although no known exploits are currently active in the wild, the presence of these tools and malware in the wild indicates a high-risk environment for telecom entities. The threat leverages multiple sophisticated tools to compromise confidentiality, integrity, and availability of targeted systems, with a high potential impact on critical infrastructure.

Detailed information about OSINT -  GALLIUM: Targeting global telecom. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:mitre-malware="china chopper - s0020"'

Filter Threats