Leviathan

Threat Actors · Leviathan

· ATT&CK GroupG0065

MUDCARPKryptonite PandaGadoliniumBRONZE MOHAWKTEMP.JumperAPT40TEMP.PeriscopeGingham Typhoon

Techniques

Software

Tactics

Aliases

Description

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: CISA Leviathan 2024)

Tactic Coverage

stealth (9)execution (8)resource development (8)persistence (7)initial access (6)privilege escalation (5)command and control (4)lateral movement (3)collection (3)credential access (2)exfiltration (2)reconnaissance (2)defense impairment (1)

Techniques Used (50)

T1003OS Credential Dumping

credential access

T1003.001LSASS Memory

credential access

T1021.001Remote Desktop Protocol

lateral movement

T1021.004SSH

lateral movement

T1027.001Binary Padding

stealth

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 50 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (17)

S0642BADFLICKmalware S0190BITSAdmintool S0069BLACKCOFFEEmalware S0020China Choppermalware S0154Cobalt Strikemalware S0021Derusbimalware S0363Empiretool S0232HOMEFRY

References (20)

https://attack.mitre.org/groups/G0065 https://www.accenture.com/us-en/blogs/cyber-defense/mudcarps-focus-on-submarine-technologies https://www.crowdstrike.com/blog/two-birds-one-stone-panda/https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a https://us-cert.cisa.gov/ncas/alerts/aa21-200a https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html https://www.secureworks.com/research/threat-profiles/bronze-mohawk