Most telecom-targeting APTs never touch a corporate laptop. Groups like LightBasin and Liminal Panda live entirely inside the signaling plane — SS7, Diameter, GRX — never triggering an enterprise EDR alert because they never enter enterprise IT in the first place. GALLIUM, tracked publicly as Soft Cell, is the inverse case: a threat actor that broke in through ordinary internet-facing IT infrastructure — vulnerable Citrix and Cisco appliances, exposed VPN endpoints — and then walked sideways from Active Directory into the telecom management plane that sits behind it.
That distinction matters for defenders. A carrier can filter every SS7 MAP operation at the interconnect and still be owned end-to-end if the domain controller managing its OSS/BSS estate falls to a credential-dumping tool that has existed since 2011. GALLIUM's seven-year run against ten carriers in more than thirty countries is the clearest public case study of what happens when telecom management infrastructure inherits the same trust model as a generic enterprise network — and gets attacked with the same generic enterprise tooling, at industrial scale, for the better part of a decade.
GALLIUM (aka Soft Cell) is a China-nexus threat actor publicly disclosed by Cybereason Nocturnus in June 2019 and separately tracked by Microsoft MSTIC. Active since at least 2012, the group compromised at least ten telecommunications carriers spanning more than thirty countries, maintaining access for over seven years using commodity RATs, off-the-shelf credential-dumping tools, and legitimate stolen VPN credentials rather than custom telecom-protocol exploits.
I. Attribution and Timeline
GALLIUM (Cybereason's designation) — also referred to as Soft Cell or Operation Soft Cell — is assessed as a China-nexus actor. Microsoft's MSTIC tracked overlapping activity independently, corroborating both the toolset and the targeting pattern in a December 2019 report.
| Metric | Detail |
|---|---|
| First observed activity | 2012 |
| Public disclosure | June 2019 (Cybereason), December 2019 (Microsoft MSTIC) |
| Dwell time | 7+ years |
| Confirmed victims | 10 carriers across 30+ countries |
| Attack surface | Enterprise IT perimeter → telecom management infrastructure |
| Primary collection | CDR, subscriber location, Active Directory data, VPN credentials |
| CVE dependency | Yes — perimeter application CVEs, not telecom-protocol zero-days |
Unlike Salt Typhoon, whose 2023–2024 campaign compressed a similar management-plane compromise into roughly a year via a single critical IOS-XE CVE, GALLIUM's operation unfolded over multiple detection-evasion cycles across nearly a decade — repeated re-entry through IT perimeter weaknesses, incremental lateral movement, and long dormant periods between active collection windows. The seven-year dwell time is not the product of one persistent implant quietly surviving undetected; it reflects an operator willing to re-establish footholds using recycled credentials whenever a previous access path was burned.
II. The Entry Point: Perimeter, Not Protocol
GALLIUM's initial access has nothing to do with telecom-specific protocols. The group targeted internet-facing Citrix and Cisco appliances and vulnerable IIS/Apache web servers — the same class of perimeter infrastructure any enterprise, in any industry, exposes to the internet for remote access and web hosting.
Once inside, GALLIUM deployed web shells on the compromised IIS/Apache hosts as a durable initial foothold — a beachhead used to stage the next phase rather than as the end goal. The objective from the outset was lateral movement into whatever sat behind that perimeter: in this case, Active Directory domains that had visibility into — and in some cases administrative reach over — telecom management systems.
III. Kill Chain Walkthrough
Phase 1 — Reconnaissance
GALLIUM performed reconnaissance of internet-facing carrier assets, specifically fingerprinting vulnerable Citrix, Cisco VPN, and IIS endpoints exposed to the public internet. This is standard external attack-surface mapping — Shodan-style scanning and version fingerprinting — with no telecom-specific tooling involved.
Technique: T1190 — Exploit Public-Facing Application
Phase 2 — Delivery
Perimeter vulnerabilities were exploited directly, with initial web shells deployed on the compromised IIS/Apache infrastructure. This gave the operators a persistent, if crude, command-execution foothold on the DMZ-facing host.
Technique: T1190 — Exploit Public-Facing Application
Phase 3 — Exploitation
From the web-shelled host, GALLIUM ran Mimikatz for OS credential dumping, enumerated Active Directory to map the domain, and moved laterally from general enterprise IT systems toward telecom-adjacent infrastructure — the OSS/BSS and management hosts that had visibility into subscriber and call data.
Techniques: T1003 — OS Credential Dumping · T1021 — Remote Services
Phase 4 — Installation
PoisonIvy and P8RAT backdoors were installed to provide durable command-and-control channels. Critically, GALLIUM also relied on stolen, legitimate VPN credentials as a persistence mechanism in their own right — access that survives an incident responder's malware cleanup if the underlying credentials are never rotated.
Technique: T1078 — Valid Accounts
Phase 5 — Command and Control
C2 traffic was designed to blend with normal management-plane HTTPS traffic, providing a long-term covert channel that supported a presence measured in years rather than weeks.
Technique: T1041 — Exfiltration Over C2 Channel
Phase 6 — Actions on Objectives
The endgame across all ten carriers was consistent: mass CDR harvesting, subscriber location tracking, and ongoing Active Directory credential theft to guarantee the operation could re-enter even after a given foothold was discovered and remediated.
Techniques: T1119 — Automated Collection · T1041 — Exfiltration Over C2 Channel
IV. The Toolset
GALLIUM's toolkit is notable for what it isn't: no custom SS7 stack, no Diameter fuzzers, no rogue base station firmware. Every tool below predates the campaign's disclosure by years and is (or was) freely available to any moderately resourced intrusion set.
| Tool | Function | Notes |
|---|---|---|
| PoisonIvy | Remote Access Trojan | Public RAT in circulation since 2005; used here for initial durable C2 |
| P8RAT | Second-stage backdoor | Minimal on-disk footprint, used for long-term covert access |
| SoftCell toolset | Custom collection/staging utilities | The only bespoke component — built for CDR extraction and staging, not protocol exploitation |
| Mimikatz | Credential dumping | Extracted plaintext credentials, hashes, and Kerberos tickets from compromised AD hosts |
| NBTScan | NetBIOS network scanner | Used for internal reconnaissance and discovery of adjacent hosts during lateral movement |
<CodeBlock language="text" is-terminal code=" # Conceptual reconstruction of GALLIUM's internal discovery phase
(illustrative — reconstructed from public reporting, not a live capture)
nbtscan -r 10.20.0.0/16
→ identifies NetBIOS-responsive hosts across the internal subnet,
surfacing OSS/BSS and management-adjacent systems for follow-on targeting
mimikatz # sekurlsa::logonpasswords
→ dumps cached credentials from LSASS on the compromised AD host,
yielding domain credentials reused for lateral movement and VPN persistence">
MITRE ATT&CK Technique Mapping
| Technique ID | Name | Tactic |
|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1078 | Valid Accounts | Persistence |
| T1003 | OS Credential Dumping | Credential Access |
| T1021 | Remote Services | Lateral Movement |
| T1083 | File and Directory Discovery | Discovery |
| T1119 | Automated Collection | Collection |
| T1041 | Exfiltration Over C2 Channel | Exfiltration |
Seven techniques, all drawn from the core ATT&CK enterprise matrix — none of them FiGHT (telecom-specific) techniques. That is itself the finding: GALLIUM never needed telecom-specific tradecraft to extract telecom-specific data.
V. The Standards Gap: An Unsegregated Management Plane
The structural failure enabling seven years of access wasn't a missing patch on any single device — patches get missed everywhere, on every network. It was that the telecom management plane was not segregated from the enterprise IT perimeter it sat behind. Once GALLIUM held domain credentials for the corporate Active Directory forest, there was no independent trust boundary, no separate credential domain, and no additional authentication layer standing between "marketing's file server" and "the system that generates CDRs for ten national carriers."
This is the same root-cause pattern documented in Salt Typhoon's 2023–2024 campaign — a flat TACACS+ credential domain spanning management-plane devices — and it recurs because the industry has historically modeled its threat monitoring around the signaling plane (SS7 firewalls, Diameter filtering per GSMA FS.11/IR.83) while treating the management plane as "just IT." GALLIUM and Salt Typhoon are the clearest public evidence that this assumption is the actual attack surface.
For a broader framing of how these phases fit into a repeatable adversary simulation, see our telecom penetration testing methodology, which treats management-plane pivoting as a first-class assessment phase alongside signaling and RAN testing.
VI. Defensive Recommendations
- Independent credential domains: Telecom management-plane authentication (OSS/BSS, mediation, billing) should not share a forest, trust relationship, or credential store with corporate IT AD.
- Jump-host enforcement with MFA: All administrative access to telecom management systems routes through hardened, MFA-protected jump hosts — never direct VPN-to-management-VLAN access.
- Perimeter patch SLAs for Citrix/Cisco/IIS: Internet-facing remote-access appliances are the single highest-value initial-access target observed across GALLIUM, Salt Typhoon, and Volt Typhoon alike; patch SLAs for these classes of device should be measured in days, not months.
- Credential rotation after any AD compromise indicator: Malware removal is not remediation. Any confirmed LSASS/Mimikatz activity requires a full rotation of every credential the compromised host could have touched, including service accounts and VPN certificates.
- Egress monitoring for automated collection: T1119 (Automated Collection) at CDR-generating systems produces a detectable data-access pattern distinct from normal operator query behavior — anomaly detection on bulk CDR queries is a viable detection control even without IOC-level visibility into the actor's tooling.
VII. Frequently Asked Questions
No. They are distinct, separately attributed China-nexus actors with different tooling, different disclosure timelines (2019 vs. 2024), and different specific entry vectors (Citrix/Cisco/IIS exploitation vs. a single Cisco IOS-XE CVE). What they share is the underlying architectural failure: a management plane trusting the same credential domain as general enterprise IT, allowing an enterprise-IT compromise to cascade into telecom-specific data theft.
Because CDR (Call Detail Record) archives, subscriber location data, and lawful-intercept metadata are frequently accessible from OSS/BSS and mediation systems that sit on the same management network as enterprise IT — not exclusively via live signaling-plane interception. An attacker with domain admin credentials on the right AD forest can query stored CDR data directly, with no protocol-level signaling exploitation required at all.
Public reporting indicates the operation used long dormancy periods between active collection windows, re-entering via freshly compromised perimeter credentials rather than relying on one implant surviving undetected the entire time. Combined with the use of legitimate stolen VPN credentials — which don't trigger malware-signature detection — this significantly extended the time before defenders correlated the activity across ten separate carrier environments as a single campaign.
It closes the specific entry vector GALLIUM used, but not the underlying architectural exposure. Even with a fully patched perimeter, an unsegregated management plane means the next commodity RAT or spearphishing campaign that lands inside corporate IT has the same lateral path into CDR and subscriber-location systems. Perimeter patching and management-plane segregation are both necessary; neither alone is sufficient.
PoisonIvy, P8RAT, Mimikatz, and NBTScan are all commodity or publicly available tools reused across many unrelated intrusion sets. The SoftCell toolset was GALLIUM's one bespoke component — purpose-built for identifying, staging, and extracting CDR data at the volumes needed to harvest ten carriers' worth of records, rather than for gaining access or moving laterally.
VIII. Authoritative Sources
- 01 Cybereason NocturnusOperation Soft Cell: A Worldwide Campaign Against Telecommunications Providers (Jun 2019)Cybereason — Operation Soft Cell →
- 02 Microsoft MSTICGALLIUM: Targeting global telecom sector with new tools (Dec 2019)
Conclusion
GALLIUM's seven years inside ten global carriers is not a story about a novel telecom exploit — it's a story about what happens when the management plane behind a carrier's perimeter is architecturally indistinguishable from any other enterprise's Active Directory forest. The entry point was Citrix and Cisco appliances any Fortune 500 company might expose; the tools were Mimikatz and a decade-old RAT; the objective was CDR and subscriber data that a properly segregated network would never have surfaced to a domain-wide credential compromise.
For operators, the takeaway sits alongside the lesson from Salt Typhoon: signaling-plane defenses (SS7/Diameter filtering, GTP monitoring) protect against a completely different threat model than the one that actually breached both of these carriers. Management-plane segregation, credential-domain isolation, and perimeter patch discipline are not optional adjacent controls — they are the primary defense against the most well-documented telecom APT campaigns on record.
