Gallium — Threat Actor Profile, Campaigns & Targets

Threat entity extracted from intelligence sources

Frequency
12
occurrences
First Seen
February 25, 2026
Last Seen
June 3, 2026

Gallium is a apt_group tracked across 6 threat clusters and 12 intelligence report mentions on ThreatCluster. First observed February 25, 2026; most recent activity June 3, 2026.

Related Threat Clusters

  • FamousSparrow APT Expands Targeting to Azerbaijani Energy Sector

    FamousSparrow, a China-aligned APT group, launched a multi-wave cyberespionage campaign against an Azerbaijani oil and gas company from late December 2025 to February 2026. The attackers employed an evolved DLL…

    10 articles · Updated May 13, 2026
  • Exploitation of Remote Services in Cyber Attacks

    Adversaries are increasingly leveraging external remote services like VPNs and Citrix to gain unauthorized access to networks. These attacks often involve using valid accounts obtained through credential harvesting or…

    2 articles · Updated June 3, 2026
  • Coruna Spyware Exploited by State Actors in Global Campaigns

    A mass cyber-espionage campaign targeting iPhone users in Ukraine and China has emerged, utilizing the Coruna exploit kit, developed by U.S. military contractor L3Harris' Trenchant division. The toolkit, comprising 23…

    4 articles · Updated March 12, 2026
  • Cyber Adversaries Exploit File Enumeration and Data Collection Techniques

    Recent reports detail the tactics employed by various cyber adversaries to enumerate files and directories on compromised systems. Adversaries utilize command shell utilities and custom tools to gather sensitive…

    2 articles · Updated April 22, 2026
  • Google Disrupts Chinese-Linked Hacking Group UNC2814 Targeting 53 Organizations

    Google has disrupted the operations of a Chinese-linked hacking group known as UNC2814, which had breached at least 53 organizations across 42 countries. The company reported the incident on February 25, 2026, detailing…

    35 articles · Updated February 25, 2026
  • Coruna iOS Exploit Kit Targets Multiple Threat Actors

    The Coruna iOS exploit kit has emerged, targeting Apple iPhone models running iOS 13.0 to 17.2.1. It includes five exploit chains and 23 exploits, with advanced techniques that are non-public. Various threat actors,…

    372 articles · Updated March 3, 2026

Recent Intelligence Reports

  • External Remote Services — attack.mitre.org · June 3, 2026
  • T1505.003 Web Shell — attack.mitre.org · May 13, 2026
  • T1005 — attack.mitre.org · April 22, 2026
  • U.S. military contractor likely built iPhone hacking tools used by Russian spies in Ukraine — Techcrunch · March 10, 2026
  • Coruna Spyware Surfaces in Global Cross Border Campaigns | Ukraine news - #Mezha — Mezha · March 10, 2026
  • Kaspersky: No signs Coruna iPhone exploit kit made by US — Theregister · March 4, 2026
  • Kaspersky dismisses claims Coruna iPhone exploit kit is connected to NSA — Theregister · March 4, 2026
  • Google disrupts Chinese-linked hackers that attacked 53 groups globally — Straitstimes · February 25, 2026

CVSS v3.1 Breakdown