S1031 PingPull

malwareEnterprise

platformsWindows

also known asPingPull

PingPull is a remote access Trojan (RAT) written in Visual C++ that has been used by GALLIUM since at least June 2022. PingPull has been used to target telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam.

techniques used (15)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1016System Network Configuration Discovery
T1036.004Masquerade Task or Service
T1041Exfiltration Over C2 Channel
T1059.003Windows Command Shell
T1070.006Timestomp
T1071.001Web Protocols
T1082System Information Discovery
T1083File and Directory Discovery
T1095Non-Application Layer Protocol
T1132.001Standard Encoding
T1140Deobfuscate/Decode Files or Information
T1543.003Windows Service
T1571Non-Standard Port
T1573.001Symmetric Cryptography

used by groups (1)

Threat groups associated with this.

G0093GALLIUM

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan