Chinese nation state threat actors have been deploying a new remote access trojan (RAT) on compromised target networks over the past year. These espionage-driven threat actors are a part of Gallium, a Chinese threat organization responsible for the targeting of numerous high-profile entities throughout the telecommunications, financial, and government organizations. Over the past year, Gallium threat actors have been targeting telecommunication entities throughout Australia, Vietnam, Mozambique, Malaysia, Cambodia, Afghanistan, and more. Once compromised, threat actors will unleash the “PingPull” malware, which comes in several variants: ICMP, TCP, and HTTPS. Each variant allows for threat actors to stealthily communicate to compromised devices through these protocols and a malware program disguised as a legitimate service, which prevents users from terminating the program. Commands issued between actor-controlled command-and-control (C2) nodes and the compromised device include file listings, read/write/delete files, enumerating storage volumes, and execute additional commands from the terminal.