MITRE ATT&CKgroup
G0065 Leviathan
- Domain
- enterprise
- Aliases
- MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper, APT40, TEMP.Periscope, Gingham Typhoon
- Version
- 4.1
- Created
- 2018-04-18
Description
Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.
Related
Uses · MITRE ATT&CK (67)
- T1027.015 Compression sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1584.008 Network Devices sub-technique
- S0642 BADFLICK software (malware)
- T1589.001 Credentials sub-technique
- T1595.002 Vulnerability Scanning sub-technique
- T1584.004 Server sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1585.002 Email Accounts sub-technique
- T1586.001 Social Media Accounts sub-technique
- T1586.002 Email Accounts sub-technique
- T1587.004 Exploits sub-technique
- T1583.001 Domains sub-technique
- T1572 Protocol Tunneling technique
- T1090.003 Multi-hop Proxy sub-technique
- T1102.003 One-Way Communication sub-technique
- T1074.001 Local Data Staging sub-technique
- T1074.002 Remote Data Staging sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.005 Visual Basic sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1560 Archive Collected Data technique
- T1559.002 Dynamic Data Exchange sub-technique
- T1003.001 LSASS Memory sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.004 SSH sub-technique
Referenced by MITRE ATT&CK · attributed to (1)
- C0049 Leviathan Australian Intrusions campaign
References
- https://www.accenture.com/us-en/blogs/cyber-defense/mudcarps-focus-on-submarine-technologies Accenture MUDCARP March 2019
- https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ Crowdstrike KRYPTONITE PANDA August 2018
- https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets Proofpoint Leviathan Oct 2017
- https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/ MSTIC GADOLINIUM September 2020
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a CISA Leviathan 2024
- https://us-cert.cisa.gov/ncas/alerts/aa21-200a CISA AA21-200A APT40 July 2021
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html FireEye Periscope March 2018
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html FireEye APT40 March 2019
- https://www.secureworks.com/research/threat-profiles/bronze-mohawk SecureWorks BRONZE MOHAWK n.d.