What tactics and techniques does Gallmaker use?

What Gallmaker’s tradecraft looks like in the kill chain

Gallmaker’s initial access relies on social engineering rather than a public-facing exploit path. The actor delivers malicious documents through spearphishing, then uses the user’s opening of the file to trigger payload execution and establish the first foothold. That makes the campaign a blend of delivery, execution, and follow-on operator activity rather than a single-stage malware event.

The important operational detail is that the document is not the end goal. It is the delivery container that bridges email into code execution, which is why defenders should treat office-document launch behavior as part of the attack chain, not as a harmless user action.

How Gallmaker moves from delivery to post-compromise activity

After the payload runs, Gallmaker performs post-compromise discovery and credential access to support later activity. Those behaviors usually indicate the actor is trying to understand the environment, identify useful accounts, and locate shared resources that can be reused for additional access or collection. In practice, discovery is often the step that turns a single compromised endpoint into a broader intrusion path.

The credential-access phase matters because it can convert one successful phish into repeated access, especially if the attacker can harvest tokens, saved credentials, or other authentication material from the compromised host. From a detection standpoint, discovery and credential access are the point where the intrusion stops being only suspicious and starts looking like active operator-led tradecraft.

Why this activity is easier to miss than it should be

Gallmaker’s technique set is effective because each action can look ordinary in isolation: an email attachment opens, a document launches a script, a process enumerates files, and a workstation probes for accounts or network shares. The combination is what makes it dangerous. When those actions occur on systems that do not normally perform administrative-style discovery, the behavior is a strong indicator that the endpoint is being used as an intrusion platform rather than as a normal user device.

That pattern also creates a detection challenge for teams that focus too narrowly on malware signatures. A document-based infection can be short-lived on disk while the post-compromise behavior continues through built-in tools, scripting engines, and native discovery commands. The practical question is not only whether the payload was seen, but whether the host began behaving like an operator console after the initial phish.

Risk and Threat Considerations

Gallmaker’s approach is risky because it combines a high-success initial access method with behaviors that help the attacker expand access after entry. Once a malicious document executes, the compromise can spread from one mailbox hit to broader account and file-system exposure if discovery and credential access succeed.

Failure mechanism: The attack succeeds when the user opens a malicious document, the payload launches from trusted software, and the actor can harvest enough environment information or credentials to continue without starting over.

Impact: The result can be follow-on access to additional systems, reuse of exposed accounts, and easier lateral movement because the attacker has mapped the local environment and identified valuable resources.

Practitioner Guidance

What to verify: Correlate email delivery, document execution, and child-process activity from office applications. If a workstation begins enumerating files, users, or shares outside its normal role, treat that as a possible post-compromise discovery phase rather than benign troubleshooting.

Decision rule: If the malicious document led to script launch, account discovery, or credential-access indicators, prioritize containment and credential review over waiting for a definitive malware family label. The fastest useful question is whether the host has been used to extend access beyond the initial attachment.

Practitioner takeaway: For this style of intrusion, the decisive signal is not the attachment itself, but the shift from user activity to operator-like discovery and credential probing on an endpoint that should not behave that way.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?