Leviathan

Origin🇨🇳 China

Techniques (MITRE ATT&CK)50

SourceMITRE ATT&CK

State sponsor: ChinaAttribution confidence: 50%Target categories: Government, Private sector

Targeted regions: United States · Hong Kong · The Philippines · Asia Pacific Economic Cooperation · Cambodia · Belgium · Germany · Philippines · Malaysia · Norway +3

Also known as:APT40ATK29BRONZE MOHAWKG0065GADOLINIUMGadoliniumGingham TyphoonISLAND CASTLEISLANDDREAMSITG09KRYPTONITE PANDAKryptonite PandaMUDCARPRed LadonTA423TEMP.JumperTEMP.Periscope

About the group

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity82

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 50

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Credentials Vulnerability Scanning

Resource development

Domains Server Network Devices Social Media Accounts Email Accounts Social Media Accounts Email Accounts Exploits

Initial access

Drive-by Compromise Exploit Public-Facing Application Spearphishing Attachment Spearphishing Link

Execution

Windows Management Instrumentation PowerShell Visual Basic Exploitation for Client Execution Malicious Link Malicious File Dynamic Data Exchange

Persistence

External Remote Services Web Shell Registry Run Keys / Startup Folder Shortcut Modification

Privilege escalation

Windows Management Instrumentation Event Subscription

Credential access

OS Credential Dumping LSASS Memory

Lateral movement

Remote Desktop Protocol SSH Internal Spearphishing

Collection

Local Data Staging Remote Data Staging Archive Collected Data

Command and control

Multi-hop Proxy One-Way Communication Ingress Tool Transfer Protocol Tunneling

Exfiltration

Exfiltration Over C2 Channel Exfiltration to Cloud Storage

defense-impairment

Code Signing

stealth

Binary Padding Steganography Encrypted/Encoded File Compression Dynamic-link Library Injection Valid Accounts Deobfuscate/Decode Files or Information BITS Jobs Regsvr32

Exploited vulnerabilities 5

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2017-11882HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2017-0199HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2017-8759HIGHEPSS 89%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

References

Leviathan uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →