What tactics and techniques does GALLIUM use?

How GALLIUM operates across phishing, access theft, and persistence

GALLIUM is best understood as an espionage-focused intrusion set that blends initial access, credential theft, and server-side persistence rather than relying on a single flashy exploit. Its tradecraft is designed to look like ordinary administrator or operator activity once it is inside a telecommunications environment, which makes early detection depend on identity signals, host persistence artefacts, and network telemetry together.

The initial access step often starts with phishing because it is a low-friction way to reach people, mail systems, or connected workflows. When that succeeds, the intrusion can move from a user-facing foothold into systems that expose administrative credentials, remote access channels, or operational trust relationships. For that reason, defenders should treat credential theft as part of the intrusion chain, not as a separate post-exploitation issue.

Persistence is the other core theme. Once GALLIUM has a foothold, it tends to keep access through mechanisms that survive normal user logoff or short-term session resets, such as new accounts, remote access tooling, and scheduled tasks on servers. That combination is especially effective in telecom and adjacent environments because long-lived operational access can blend into routine maintenance if the environment lacks strong separation and alerting.

What defenders should look for in the intrusion chain

Several of the most useful clues are behavioural rather than signature-based. Unusual administrative activity, especially from accounts or hosts that do not normally perform privileged tasks, is a strong indicator of compromise. New local or domain accounts, changes to remote access patterns, and persistence artefacts such as scheduled tasks are all worth correlating against helpdesk tickets, change records, and maintenance windows.

Outbound command-and-control traffic is another practical indicator, but it is most valuable when paired with identity and host context. A server that suddenly initiates external connections after a new account is created or a scheduled task appears is more suspicious than a network event in isolation. In telecom environments, where many systems legitimately communicate outward, the key question is whether the destination, timing, or process behaviour matches the baseline for that system.

Threat Actor Groups Guide is useful here because it helps teams connect a named actor like GALLIUM to the broader conventions used for threat-group tracking and analysis.

Why this matters for telecom environments and critical servers

Telecommunications networks concentrate authentication, remote administration, and service continuity in a relatively small set of systems, which makes successful intrusion disproportionately valuable to an espionage actor. If a server or admin pathway is compromised, the attacker may gain durable visibility into traffic, users, or internal operations without needing repeated phishing or noisy exploitation. That is why segmentation, strict privilege boundaries, and strong monitoring are part of the detection problem, not just the hardening problem.

Phishing remains a central starting point because it can deliver a first credential, session, or execution foothold that later enables remote access and persistence. Top 10 Phishing Techniques helps teams recognise the specific lure styles and credential-theft patterns that commonly precede deeper intrusion activity.

Defenders should also assume that an intrusion may be quiet for a long time. Espionage campaigns often value access quality over speed, so they may avoid disruptive actions until they have established reliable reach. That means the most important detection work is often around logon anomalies, new privileged principals, remote access changes, and server persistence rather than only around obvious malware alerts.

Risk and Threat Considerations

GALLIUM’s tradecraft is risky because it targets the trust relationships that keep telecom and related environments running, especially admin access and server persistence. Once those relationships are abused, the attacker can remain embedded while appearing operationally normal, which raises both confidentiality risk and the chance of follow-on lateral movement.

Failure mechanism: Phishing or stolen credentials open the door to remote access, after which the attacker creates or abuses durable footholds such as scheduled tasks, additional accounts, or trusted administrative pathways. That lets the intrusion survive simple password resets or a single host cleanup.

Impact: The organisation can lose visibility into who is actually operating critical systems, and the attacker may maintain long-term access to infrastructure that supports communications, administration, or internal intelligence collection.

Practitioner Guidance

What to prioritise: Correlate identity events, server changes, and outbound network activity before you focus on malware family attribution. For this kind of actor, the strongest signal is usually the sequence, first access, then privilege, then persistence, not any single alert.

What to verify: Check whether new accounts, new scheduled tasks, or remote-access changes were explicitly approved and whether they align with a known maintenance workflow. If they cannot be tied to a business change, treat them as high-suspicion artefacts rather than housekeeping noise.

Practitioner takeaway: The best defence against GALLIUM is to make privileged access observable and short-lived, because espionage actors usually win by blending persistence into routine administration, not by detonating obvious malware.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?