H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[MURKYTOP](https://attack.mitre.org/software/S0233) is a reconnaissance tool used by [Leviathan](https://attack.mitre.org/groups/G0065). (Citation: FireEye Periscope March 2018)

Labels

malware

10 recorded

Relationships

uses

from Leviathan

Group

uses

to At

Technique

uses

to File Deletion

Technique

uses

to Local Account

Technique

uses

to Network Service Discovery

Technique

uses

to Network Share Discovery

Technique

uses

to Permission Groups Discovery

Technique

uses

to Remote System Discovery

Technique

uses

to System Information Discovery

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S0233

open

MURKYTOP

—

FireEye Periscope March 2018

https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html

open