PingPull
- ID
- S1031
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 17 Apr 2025
PingPull is a remote access Trojan (RAT) written in Visual C++ that has been used by GALLIUM since at least June 2022. PingPull has been used to target telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam.[1]
Techniques used (15)
- T1005 Data from Local System
- T1016 System Network Configuration Discovery
- T1036.004 Masquerade Task or Service
- T1041 Exfiltration Over C2 Channel
- T1059.003 Windows Command Shell
- T1070.006 Timestomp
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1095 Non-Application Layer Protocol
- T1132.001 Standard Encoding
- T1140 Deobfuscate/Decode Files or Information
- T1543.003 Windows Service
- T1571 Non-Standard Port
- T1573.001 Symmetric Cryptography