MITRE ATT&CKcampaign

C0049 Leviathan Australian Intrusions

Published 2025-02-03 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2025-02-03

Description

Leviathan Australian Intrusions consisted of at least two long-term intrusions against victims in Australia by Leviathan, relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. Leviathan Australian Intrusions were focused on exfiltrating sensitive data including valid credentials for the victim organizations.

Related

Attributed to · MITRE ATT&CK (1)

Uses · MITRE ATT&CK (26)

  • T1686 Disable or Modify System Firewall technique
  • T1213.006 Databases sub-technique
  • T1615 Group Policy Discovery technique
  • T1588.006 Vulnerabilities sub-technique
  • T1594 Search Victim-Owned Websites technique
  • T1074.001 Local Data Staging sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1021.004 SSH sub-technique
  • T1558.003 Kerberoasting sub-technique
  • T1552 Unsecured Credentials technique
  • T1552.001 Credentials In Files sub-technique
  • T1505.003 Web Shell sub-technique
  • T1528 Steal Application Access Token technique
  • T1482 Domain Trust Discovery technique
  • T1190 Exploit Public-Facing Application technique
  • T1212 Exploitation for Credential Access technique
  • T1135 Network Share Discovery technique
  • T1018 Remote System Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1056 Input Capture technique
  • T1068 Exploitation for Privilege Escalation technique
  • T1078 Valid Accounts technique
  • T1082 System Information Discovery technique
  • T1111 Multi-Factor Authentication Interception technique

References