AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Leviathan
Aliases: APT40, BRONZE MOHAWK, Gadolinium, Gingham Typhoon, Kryptonite Panda, Leviathan, MUDCARP, TEMP.Jumper, TEMP.Periscope
[Leviathan](https://attack.mitre.org/groups/G0065) is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, [Leviathan](https://attack.mitre.org/groups/G0065) has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: CISA Leviathan 2024)
Open interactive actor investigation
ATT&CK techniques
T1003T1003.001T1021.001T1021.004T1027.001T1027.003T1027.013T1027.015T1041T1047T1055.001T1059.001T1059.005T1074.001T1074.002T1078T1090.003T1102.003T1105T1133T1140T1189T1190T1197T1203T1204.001T1204.002T1218.010T1505.003T1534T1546.003T1547.001T1547.009T1553.002T1559.002T1560T1566.001T1566.002T1567.002T1572T1583.001T1584.004T1584.008T1585.001T1585.002T1586.001T1586.002T1587.004T1589.001T1595.002
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Windows Credential Editor tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- at tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Cobalt Strike tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tor tool reference — Explicit actor uses software relationship in pinned ATT&CK
- BITSAdmin tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PowerSploit tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Empire tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003 OS Credential Dumping simulation — Exact active technique ID
- T1003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
- T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.004 SSH simulation — Exact active technique ID
- T1021.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.001 Binary Padding simulation — Exact active technique ID
- T1027.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.003 Steganography simulation — Exact active technique ID
- T1027.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.013 Encrypted/Encoded File simulation — Exact active technique ID
- T1027.013 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.015 Compression simulation — Exact active technique ID
- T1027.015 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1041 Exfiltration Over C2 Channel simulation — Exact active technique ID
- T1041 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055.001 Dynamic-link Library Injection simulation — Exact active technique ID
- T1055.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.005 Visual Basic simulation — Exact active technique ID
- T1059.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.001 Local Data Staging simulation — Exact active technique ID
- T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.002 Remote Data Staging simulation — Exact active technique ID
- T1074.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.003 Multi-hop Proxy simulation — Exact active technique ID
- T1090.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102.003 One-Way Communication simulation — Exact active technique ID
- T1102.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1189 Drive-by Compromise simulation — Exact active technique ID
- T1189 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1197 BITS Jobs simulation — Exact active technique ID
- T1197 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.001 Malicious Link simulation — Exact active technique ID
- T1204.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.010 Regsvr32 simulation — Exact active technique ID
- T1218.010 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1505.003 Web Shell simulation — Exact active technique ID
- T1505.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1534 Internal Spearphishing simulation — Exact active technique ID
- T1534 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1546.003 Windows Management Instrumentation Event Subscription simulation — Exact active technique ID
- T1546.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.009 Shortcut Modification simulation — Exact active technique ID
- T1547.009 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1553.002 Code Signing simulation — Exact active technique ID
- T1553.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1559.002 Dynamic Data Exchange simulation — Exact active technique ID
- T1559.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560 Archive Collected Data simulation — Exact active technique ID
- T1560 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.002 Spearphishing Link simulation — Exact active technique ID
- T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1567.002 Exfiltration to Cloud Storage simulation — Exact active technique ID
- T1567.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1572 Protocol Tunneling simulation — Exact active technique ID
- T1572 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.004 Server simulation — Exact active technique ID
- T1584.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1584.008 Network Devices simulation — Exact active technique ID
- T1584.008 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.001 Social Media Accounts simulation — Exact active technique ID
- T1585.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1585.002 Email Accounts simulation — Exact active technique ID
- T1585.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1586.001 Social Media Accounts simulation — Exact active technique ID
- T1586.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1586.002 Email Accounts simulation — Exact active technique ID
- T1586.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.004 Exploits simulation — Exact active technique ID
- T1587.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1589.001 Credentials simulation — Exact active technique ID
- T1589.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1595.002 Vulnerability Scanning simulation — Exact active technique ID
- T1595.002 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 11 — Email, web, API, data, and insider defense
Blue Team & Defensive Security · explicit-nameBinary formats, ABI, loaders, and mitigations
Vulnerability Research & Exploit Development · explicit-nameEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · explicit-nameFiles, parsers, serialization, URL fetching, and isolation
Secure Code & Application Security · explicit-nameImages, video, audio, geolocation, chronolocation, and media verification
OSINT & Reconnaissance · explicit-nameInfrastructure, network, resource, and availability security
AI Security · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 11 — Email, web, API, data, and insider defense
Blue Team & Defensive Security · explicit-nameBinary formats, ABI, loaders, and mitigations
Vulnerability Research & Exploit Development · explicit-nameEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · explicit-nameFiles, parsers, serialization, URL fetching, and isolation
Secure Code & Application Security · explicit-nameImages, video, audio, geolocation, chronolocation, and media verification
OSINT & Reconnaissance · explicit-nameInfrastructure, network, resource, and availability security
AI Security · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-name