Operation Soft Cell — APT Profile

Operation Soft Cell is the label Cybereason gave a long-running intrusion set it uncovered in 2018 inside telecommunications carriers, and which the vendor assessed had been running since at least 2012. Per Cybereason's Nocturnus team, the operators worked in waves across roughly six months, pivoting from web shells on internet-facing servers to full domain control, and their priority was call detail records — the metadata showing who called whom, for how long, and from where — for a short list of individuals rather than bulk subscriber data. The toolkit was largely borrowed rather than bespoke: an altered China Chopper web shell, a renamed Mimikatz build, PoisonIvy loaded by DLL side-loading, a modified nbtscan, the hTran proxy, and WinRAR for staging exfiltration. Cybereason judged the operation Chinese and probably state-directed, noting overlap with APT10's tooling while allowing that shared toolkits could explain it. Microsoft, Palo Alto Networks Unit 42 and MITRE ATT&CK fold the same activity into GALLIUM, or Granite Typhoon, which Unit 42 has since tracked into finance and government targets from Afghanistan and Southeast Asia to Mozambique and Russia using the PingPull RAT.

Tools & malware

Vendor research

Read the full analysis on IntelFusions