Threat intelligence / Campaign

Leviathan Australian Intrusions

[Leviathan Australian Intrusions](https://attack.mitre.org/campaigns/C0049) consisted of at least two long-term intrusions against victims in Australia by [Leviathan](https://attack.mitre.org/groups/G0065), relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. [Leviathan Australian Intrusions](https://attack.mitre.org/campaigns/C0049) were focused on exfiltrating sensitive data including valid credentials for the victim organizations.(Citation: CISA Leviathan 2024)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Leviathan Australian Intrusions](https://attack.mitre.org/campaigns/C0049) consisted of at least two long-term intrusions against victims in Australia by [Leviathan](https://attack.mitre.org/groups/G0065), relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. [Leviathan Australian Intrusions](https://attack.mitre.org/campaigns/C0049) were focused on exfiltrating sensitive data including valid credentials for the victim organizations.(Citation: CISA Leviathan 2024)

27 recorded

Relationships

attributed-to

Group

uses

to Credentials In Files

Technique

uses

Technique

uses

to Disable or Modify System Firewall

Technique

uses

to Domain Accounts

Technique

uses

to Domain Trust Discovery

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploitation for Credential Access

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to Group Policy Discovery

Technique

uses

to Input Capture

Technique

uses

to Kerberoasting

Technique

uses

to Local Accounts

Technique

uses

to Local Data Staging

Technique

uses

to Multi-Factor Authentication Interception

Technique

uses

to Network Share Discovery

Technique

uses

to Remote System Discovery

Technique

uses

to Search Victim-Owned Websites

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to SSH

Technique

uses

to Steal Application Access Token

Technique

uses

to System Information Discovery

Technique

uses

to Unsecured Credentials

Technique

uses

to Valid Accounts

Technique

uses

to Vulnerabilities

Technique

uses

Technique

2 external

References

mitre-attack

C0049

CISA Leviathan 2024

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a