Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.1 Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.2345
- CISA AA21-200A APT40 July 2021
- CISA AA21-200A APT40 July 2021
- Proofpoint Leviathan Oct 2017
- FireEye Periscope March 2018
- CISA Leviathan 2024
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1567.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1595.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.009 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1197 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1534 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.008 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.015 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1586.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003 | OS Credential Dumping | — |
| T1003.001 | LSASS Memory | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1027.001 | Binary Padding | — |
| T1027.003 | Steganography | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1027.015 | Compression | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1047 | Windows Management Instrumentation | — |
| T1055.001 | Dynamic-link Library Injection | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1074.001 | Local Data Staging | — |
| T1074.002 | Remote Data Staging | — |
| T1078 | Valid Accounts | — |
| T1090.003 | Multi-hop Proxy | — |
| T1102.003 | One-Way Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1133 | External Remote Services | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1189 | Drive-by Compromise | — |
| T1190 | Exploit Public-Facing Application | — |
| T1197 | BITS Jobs | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.010 | Regsvr32 | — |
| T1505.003 | Web Shell | — |
| T1534 | Internal Spearphishing | — |
| T1546.003 | Windows Management Instrumentation Event Subscription | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1547.009 | Shortcut Modification | — |
| T1553.002 | Code Signing | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1560 | Archive Collected Data | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1572 | Protocol Tunneling | — |
| T1583.001 | Domains | — |
| T1584.004 | Server | — |
| T1584.008 | Network Devices | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1586.001 | Social Media Accounts | — |
| T1586.002 | Email Accounts | — |
| T1587.004 | Exploits | — |
| T1589.001 | Credentials | — |
| T1595.002 | Vulnerability Scanning | — |
别名
APT40 · BRONZE MOHAWK · Gadolinium · Gingham Typhoon · Kryptonite Panda · Leviathan · MUDCARP · TEMP.Jumper · TEMP.Periscope
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。