Netskope Threat Labs

PingPull

ATP Sandbox Adv. Heuristics

Description

PingPull is a remote access trojan written in Visual C++ that the GALLIUM threat group has used since at least June 2022. Its campaigns have targeted telecommunications companies, financial institutions, and government entities across countries including Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam.

Stats

First seen
July 2022
Last seen
October 2026

Also known as

Pingpull

MITRE ATT&CK techniques

15 techniques across 7 tactics.

TA0002 Execution

TA0003 Persistence

TA0005 Stealth

TA0007 Discovery

  • T1016System Network Configuration Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery

TA0009 Collection

  • T1005Data from Local System

TA0011 Command and Control

TA0010 Exfiltration

  • T1041Exfiltration Over C2 Channel

Associated groups

Alert name variants

Alert Name
Linux.Trojan.PingPull
Win64.Backdoor.Pingpull

Related families

BisonalPlugXQakBotInvisiMoleKONNI

References