Microsoft GALLIUM December 2019

GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.

BlackMould can copy files on a compromised host.

BlackMould can run cmd.exe with parameters.

BlackMould can send commands to C2 in the body of HTTP POST requests.

BlackMould has the ability to find files on the targeted system.

GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.

BlackMould has the ability to download files to the victim's machine.

GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.

GALLIUM created high-privileged domain user accounts to maintain access to victim networks.

GALLIUM exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.

GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.

GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.

GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.

GALLIUM has used PsExec to move laterally between hosts in the target network.

GALLIUM has used Taiwan-based servers that appear to be exclusive to GALLIUM.

GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.

BlackMould can enumerate local drives on a compromised host.