Chinese APT Gallium has been observed using a previously undocumented RAT in its espionage attacks targeting companies operating in Southeast Asia, Europe, and Africa. Called PingPull, the backdoor is notable for its use of the Internet Control Message Protocol (ICMP) for C2. Victims Gallium, a.k.a Soft Cell, is known for its attacks primarily aimed at telecom companies dating as far back as 2012. However, over the past year, the group is said to have expanded its victims to include financial institutions and government entities located in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam.