G0065 · 45 ATT&CK techniques · 1 correlated reports

Leviathan

Aliases: MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper, APT40, TEMP.Periscope, Gingham Typhoon

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Europe, the Middle East, and Southeast Asia.

Open interactive actor investigation

ATT&CK techniques

T1567.002
Exfiltration to Cloud Storage T1102.003
One-Way Communication T1047
Windows Management Instrumentation T1021.004
SSH T1105
Ingress Tool Transfer T1547.001
Registry Run Keys / Startup Folder T1027.013
Encrypted/Encoded File T1589.001
Credentials T1003.001
LSASS Memory T1586.001
Social Media Accounts T1090.003
Multi-hop Proxy T1027.001
Binary Padding T1583.001
Domains T1585.002
Email Accounts T1566.002
Spearphishing Link T1189
Drive-by Compromise T1546.003
Windows Management Instrumentation Event Subscription T1027.003
Steganography T1585.001
Social Media Accounts T1059.001
PowerShell T1547.009
Shortcut Modification T1055.001
Dynamic-link Library Injection T1566.001
Spearphishing Attachment T1203
Exploitation for Client Execution T1059.005
Visual Basic T1078
Valid Accounts T1553.002
Code Signing T1559.002
Dynamic Data Exchange T1197
BITS Jobs T1074.001
Local Data Staging T1204.002
Malicious File T1140
Deobfuscate/Decode Files or Information T1074.002
Remote Data Staging T1534
Internal Spearphishing T1218.010
Regsvr32 T1041
Exfiltration Over C2 Channel T1505.003
Web Shell T1021.001
Remote Desktop Protocol T1560
Archive Collected Data T1572
Protocol Tunneling T1204.001
Malicious Link T1133
External Remote Services T1003
OS Credential Dumping T1586.002
Email Accounts T1059.003
Windows Command Shell

Correlated CTI and IR reports

ATT&CK as a Working Tool: Theory and Hands-On Practical Usage
1200km CTI repository · explicit report mention

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research