Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.1 Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.2345
- CISA AA21-200A APT40 July 2021
- CISA AA21-200A APT40 July 2021
- Proofpoint Leviathan Oct 2017
- FireEye Periscope March 2018
- CISA Leviathan 2024
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1567.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.009 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1197 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1534 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.008 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.015 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003 | OS Credential Dumping | — |
| T1003.001 | LSASS Memory | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1027.001 | Binary Padding | — |
| T1027.003 | Steganography | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1027.015 | Compression | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1047 | Windows Management Instrumentation | — |
| T1055.001 | Dynamic-link Library Injection | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1074.001 | Local Data Staging | — |
| T1074.002 | Remote Data Staging | — |
| T1078 | Valid Accounts | — |
| T1090.003 | Multi-hop Proxy | — |
| T1102.003 | One-Way Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1133 | External Remote Services | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1190 | Exploit Public-Facing Application | — |
| T1197 | BITS Jobs | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.010 | Regsvr32 | — |
| T1505.003 | Web Shell | — |
| T1534 | Internal Spearphishing | — |
| T1546.003 | Windows Management Instrumentation Event Subscription | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1547.009 | Shortcut Modification | — |
| T1553.002 | Code Signing | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1560 | Archive Collected Data | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1572 | Protocol Tunneling | — |
| T1583.001 | Domains | — |
| T1584.004 | Server | — |
| T1584.008 | Network Devices | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1586.001 | Social Media Accounts | — |
| T1586.002 | Email Accounts | — |
| T1587.004 | Exploits | — |
| T1589.001 | Credentials | — |
| T1595.002 | Vulnerability Scanning | — |
Aliases
APT40 · BRONZE MOHAWK · Gadolinium · Gingham Typhoon · Kryptonite Panda · Leviathan · MUDCARP · TEMP.Jumper · TEMP.Periscope
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.