Leviathan
Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.
- ATT&CK ID
- G0065
- Origin
- China
- Weather family
- Typhoon
- Techniques
- 37
- Tools
- 17
Also tracked as MUDCARP · Kryptonite Panda · Gadolinium · BRONZE MOHAWK · TEMP.Jumper · APT40 · TEMP.Periscope · Gingham Typhoon
Vulnerabilities it has exploited
- CVE-2017-0199 Microsoft Office and WordPadUnscored · exploited in the wild
- CVE-2017-11882 Microsoft OfficeUnscored · exploited in the wild
- CVE-2017-8759 Microsoft .NET FrameworkUnscored · exploited in the wild
Techniques
Reconnaissance
Gather Victim Identity InformationActive Scanning
Resource Development
Acquire InfrastructureCompromise InfrastructureEstablish AccountsCompromise AccountsDevelop Capabilities
Initial Access
Valid AccountsExternal Remote ServicesDrive-by CompromiseExploit Public-Facing ApplicationPhishing
Execution
Windows Management InstrumentationCommand and Scripting InterpreterBITS JobsExploitation for Client ExecutionUser ExecutionInter-Process Communication
Persistence
Valid AccountsExternal Remote ServicesBITS JobsServer Software ComponentEvent Triggered ExecutionBoot or Logon Autostart Execution
Privilege Escalation
Process InjectionValid AccountsEvent Triggered ExecutionBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationProcess InjectionValid AccountsDeobfuscate/Decode Files or InformationBITS JobsSystem Binary Proxy Execution
Defense Impairment
Credential Access
Lateral Movement
Remote ServicesInternal Spearphishing
Collection
Data StagedArchive Collected Data
Command and Control
ProxyWeb ServiceIngress Tool TransferProtocol Tunneling
Exfiltration
Exfiltration Over C2 ChannelExfiltration Over Web Service
Software
BADFLICK · BITSAdmin · BLACKCOFFEE · China Chopper · Cobalt Strike · Derusbi · Empire · HOMEFRY · MURKYTOP · NanHaiShu · Net · Orz · PowerSploit · Tor · Windows Credential Editor · at · gh0st RAT