Leviathan

Threat actor

Attributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.

Names and who uses them

LeviathanOur name
APT40CISA
BRONZE MOHAWKCISA
GadoliniumCISA
Kryptonite PandaCISA
MUDCARPCISA
TEMP.JumperCISA
TEMP.PeriscopeCISA
Gingham TyphoonMicrosoft

Targets

Sectors: Government, Defence, Healthcare, Manufacturing, Aerospace, Transport, Maritime

Regions: Europe, Middle East, South East Asia, United States, Australia, Canada

Source: MITRE ATT&CK

Known techniques

T1003OS Credential Dumping
T1003.001LSASS Memory
T1021.001Remote Desktop Protocol
T1021.004SSH
T1027.001Binary Padding
T1027.003Steganography
T1027.013Encrypted/Encoded File
T1027.015Compression
T1041Exfiltration Over C2 Channel
T1047Windows Management Instrumentation
T1055.001Dynamic-link Library Injection
T1059.001PowerShell
T1059.005Visual Basic
T1074.001Local Data Staging
T1074.002Remote Data Staging
T1078Valid Accounts
T1090.003Multi-hop Proxy
T1102.003One-Way Communication
T1105Ingress Tool Transfer
T1133External Remote Services
T1140Deobfuscate/Decode Files or Information
T1189Drive-by Compromise
T1190Exploit Public-Facing Application
T1197BITS Jobs
T1203Exploitation for Client Execution
T1204.001Malicious Link
T1204.002Malicious File
T1218.010Regsvr32
T1505.003Web Shell
T1534Internal Spearphishing
T1546.003Windows Management Instrumentation Event Subscription
T1547.001Registry Run Keys / Startup Folder
T1547.009Shortcut Modification
T1553.002Code Signing
T1559.002Dynamic Data Exchange
T1560Archive Collected Data
T1566.001Spearphishing Attachment
T1566.002Spearphishing Link
T1567.002Exfiltration to Cloud Storage
T1572Protocol Tunneling

Source: MITRE ATT&CK

Malware and tools used

at BADFLICK BITSAdmin BLACKCOFFEE China Chopper Cobalt Strike Derusbi Empire gh0st RAT HOMEFRY MURKYTOP NanHaiShu Net Orz PowerSploit Tor Windows Credential Editor

Source: MITRE ATT&CK

Recent news

No stories yet.