Threat intelligence / Group

Leviathan

[Leviathan](https://attack.mitre.org/groups/G0065) is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, [Leviathan](https://attack.mitre.org/groups/G0065) has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: CISA Leviathan 2024)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

68 recorded

Relationships

attributed-to

from Leviathan Australian Intrusions

Campaign

uses

to Archive Collected Data

Technique

uses

to at

Tool

uses

to BADFLICK

Malware

uses

to Binary Padding

Technique

uses

to BITSAdmin

Tool

uses

to BITS Jobs

Technique

uses

to BLACKCOFFEE

Malware

uses

to China Chopper

Malware

uses

to Cobalt Strike

Malware

uses

to Code Signing

Technique

uses

to Compression

Technique

uses

to Credentials

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Derusbi

Malware

uses

to Domains

Technique

uses

to Drive-by Compromise

Technique

uses

to Dynamic Data Exchange

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Email Accounts

Technique

uses

to Email Accounts

Technique

uses

to Empire

Tool

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to Exploits

Technique

uses

to External Remote Services

Technique

uses

to gh0st RAT

Malware

uses

to HOMEFRY

Malware

uses

to Ingress Tool Transfer

Technique

uses

to Internal Spearphishing

Technique

uses

to Local Data Staging

Technique

uses

to LSASS Memory

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Multi-hop Proxy

Technique

uses

to MURKYTOP

Malware

uses

to NanHaiShu

Malware

uses

to Net

Tool

uses

to Network Devices

Technique

uses

to One-Way Communication

Technique

uses

to Orz

Malware

uses

to OS Credential Dumping

Technique

uses

to PowerShell

Technique

uses

to PowerSploit

Tool

uses

to Protocol Tunneling

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Regsvr32

Technique

uses

to Remote Data Staging

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Server

Technique

uses

to Shortcut Modification

Technique

uses

to Social Media Accounts

Technique

uses

to Social Media Accounts

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to SSH

Technique

uses

to Steganography

Technique

uses

to Tor

Tool

uses

to Valid Accounts

Technique

uses

to Visual Basic

Technique

uses

to Vulnerability Scanning

Technique

uses

to Web Shell

Technique

uses

to Windows Credential Editor

Tool

uses

to Windows Management Instrumentation

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

20 external

References

mitre-attack

G0065

open

MUDCARP

—

Kryptonite Panda

—

Gadolinium

—

BRONZE MOHAWK

—

Gingham Typhoon

—

Leviathan

—

TEMP.Jumper

—

TEMP.Periscope

—

Accenture MUDCARP March 2019

https://www.accenture.com/us-en/blogs/cyber-defense/mudcarps-focus-on-submarine-technologies

open

Crowdstrike KRYPTONITE PANDA August 2018

https://www.crowdstrike.com/blog/two-birds-one-stone-panda/

open

Proofpoint Leviathan Oct 2017

https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets

open

MSTIC GADOLINIUM September 2020

https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/

open

CISA Leviathan 2024

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a

open

CISA AA21-200A APT40 July 2021

https://us-cert.cisa.gov/ncas/alerts/aa21-200a

open

APT40

—

FireEye Periscope March 2018

https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html

open

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

open

FireEye APT40 March 2019

https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html

open

SecureWorks BRONZE MOHAWK n.d.

https://www.secureworks.com/research/threat-profiles/bronze-mohawk

open