LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

EnterpriseG0065GroupObject v4.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

G0065: Leviathan describes [Leviathan](https://attack.mitre.org/groups/G0065) is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, [Leviathan](https://attack.mitre.org/groups/G0065) has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transpor...

Executive priority

G0065: Leviathan is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0065: Leviathan by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether G0065: Leviathan appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

50 rows
DomainIDNameRelationship / procedure
EnterpriseT1567.002Exfiltration to Cloud StorageSub-technique

Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.[2][3]

EnterpriseT1595.002Vulnerability ScanningSub-technique

Leviathan has conducted reconnaissance against target networks of interest looking for vulnerable, end-of-life, or no longer maintainted devices against which to rapidly deploy exploits.[4]

EnterpriseT1102.003One-Way CommunicationSub-technique

Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.[3]

EnterpriseT1047Windows Management Instrumentation

Leviathan has used WMI for execution.[2]

EnterpriseT1021.004SSHSub-technique

Leviathan used ssh for internal reconnaissance.[5]

EnterpriseT1105Ingress Tool Transfer

Leviathan has downloaded additional scripts and files from adversary-controlled servers.[2][3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.[2][3]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Leviathan has obfuscated code using base64.[2]

EnterpriseT1589.001CredentialsSub-technique

Leviathan has collected compromised credentials to use for targeting efforts.[1]

EnterpriseT1003.001LSASS MemorySub-technique

Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.[5]

EnterpriseT1586.001Social Media AccountsSub-technique

Leviathan has compromised social media accounts to conduct social engineering attacks.[1]

EnterpriseT1090.003Multi-hop ProxySub-technique

Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.[1]

EnterpriseT1027.001Binary PaddingSub-technique

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.[2]

EnterpriseT1583.001DomainsSub-technique

Leviathan has established domains that impersonate legitimate entities to use for targeting efforts. [1][6]

EnterpriseT1585.002Email AccountsSub-technique

Leviathan has created new email accounts for targeting efforts.[1]

EnterpriseT1566.002Spearphishing LinkSub-technique

Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.[2][1]

EnterpriseT1189Drive-by Compromise

Leviathan has infected victims using watering holes.[1]

EnterpriseT1546.003Windows Management Instrumentation Event SubscriptionSub-technique

Leviathan has used WMI for persistence.[3]

EnterpriseT1027.003SteganographySub-technique

Leviathan has used steganography to hide stolen data inside other files stored on Github.[1]

EnterpriseT1585.001Social Media AccountsSub-technique

Leviathan has created new social media accounts for targeting efforts.[1]

EnterpriseT1059.001PowerShellSub-technique

Leviathan has used PowerShell for execution.[2][3][1][6]

EnterpriseT1547.009Shortcut ModificationSub-technique

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.[2][3]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.[6]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.[2][1]

EnterpriseT1584.004ServerSub-technique

Leviathan has used compromised legitimate websites as command and control nodes for operations.[4]

EnterpriseT1203Exploitation for Client Execution

Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.[2][3][1][6]

EnterpriseT1059.005Visual BasicSub-technique

Leviathan has used VBScript.[2]

EnterpriseT1078Valid Accounts

Leviathan has obtained valid accounts to gain initial access.[1][6][4]

EnterpriseT1553.002Code SigningSub-technique

Leviathan has used stolen code signing certificates to sign malware.[3][5]

EnterpriseT1559.002Dynamic Data ExchangeSub-technique

Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents. [6]

EnterpriseT1587.004ExploitsSub-technique

Leviathan has rapidly transformed and adapted public exploit proof-of-concept code for new vulnerabilities and utilized them against target networks.[4]

EnterpriseT1197BITS Jobs

Leviathan has used BITSAdmin to download additional tools.[3]

EnterpriseT1074.001Local Data StagingSub-technique

Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.[3][1]

EnterpriseT1204.002Malicious FileSub-technique

Leviathan has sent spearphishing attachments attempting to get a user to click.[2][1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.[2]

EnterpriseT1074.002Remote Data StagingSub-technique

Leviathan has staged data remotely prior to exfiltration.[1]

EnterpriseT1534Internal Spearphishing

Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.[1]

EnterpriseT1190Exploit Public-Facing Application

Leviathan has used exploits against publicly-disclosed vulnerabilities for initial access into victim networks.[4]

EnterpriseT1218.010Regsvr32Sub-technique

Leviathan has used regsvr32 for execution.[2]

EnterpriseT1041Exfiltration Over C2 Channel

Leviathan has exfiltrated data over its C2 channel.[1]

EnterpriseT1505.003Web ShellSub-technique

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.[5][1][4]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

Leviathan has targeted RDP credentials and used it to move through the victim environment.[5]

EnterpriseT1584.008Network DevicesSub-technique

Leviathan has used compromised networking devices, such as small office/home office (SOHO) devices, as operational command and control infrastructure.[4]

EnterpriseT1027.015CompressionSub-technique

Leviathan has obfuscated code using gzip compression.[2]

EnterpriseT1560Archive Collected Data

Leviathan has archived victim's data prior to exfiltration.[1]

EnterpriseT1572Protocol Tunneling

Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.[1]

EnterpriseT1204.001Malicious LinkSub-technique

Leviathan has sent spearphishing email links attempting to get a user to click.[2][1]

EnterpriseT1133External Remote Services

Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.[1]

EnterpriseT1586.002Email AccountsSub-technique

Leviathan has compromised email accounts to conduct social engineering attacks.[1]

EnterpriseT1003OS Credential Dumping

Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.[5]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0110: at

at is used to schedule tasks on a system to run at a specified date or time.[1][2]

LinuxWindowsmacOS
ToolEnterprise

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows
ToolEnterprise

S0039: Net

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]

Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

Windows
ToolEnterprise

S0194: PowerSploit

PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]

Windows
CampaignEnterprise

C0049: Leviathan Australian Intrusions

Leviathan Australian Intrusions consisted of at least two long-term intrusions against victims in Australia by Leviathan, relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. Leviathan Australian Intrusions were focused on exfiltrating sensitive data including valid credentials for the victim organizations.[1]

Relationship explorer

All related ATT&CK context

attributed to · CampaignC0049: Leviathan Australian IntrusionsEnterpriseuses · TechniqueT1567.002: Exfiltration to Cloud StorageEnterpriseuses · TechniqueT1595.002: Vulnerability ScanningEnterpriseuses · TechniqueT1102.003: One-Way CommunicationEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · ToolS0005: Windows Credential EditorEnterpriseuses · TechniqueT1021.004: SSHEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1589.001: CredentialsEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterpriseuses · TechniqueT1586.001: Social Media AccountsEnterpriseuses · ToolS0190: BITSAdminEnterpriseuses · TechniqueT1090.003: Multi-hop ProxyEnterpriseuses · TechniqueT1027.001: Binary PaddingEnterpriseuses · MalwareS0232: HOMEFRYEnterpriseuses · TechniqueT1583.001: DomainsEnterpriseuses · MalwareS0021: DerusbiEnterpriseuses · ToolS0110: atEnterpriseuses · TechniqueT1585.002: Email AccountsEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · MalwareS0069: BLACKCOFFEEEnterpriseuses · TechniqueT1189: Drive-by CompromiseEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
4.1
Created
Modified
Raw hash
d693cb17ff1de93d...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.24.1Current bundled693cb17ff1d…
19.14.1Older bundle18ed60da4f10…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CISA AA21-200A APT40 July 2021

    CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.

    Open source URL
  2. [2]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  3. [3]
    FireEye Periscope March 2018

    FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

    Open source URL
  4. [4]
    CISA Leviathan 2024

    CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025.

    Open source URL
  5. [5]
    FireEye APT40 March 2019

    Plan, F., et al. (2019, March 4). APT40: Examining a China-Nexus Espionage Actor. Retrieved March 18, 2019.

    Open source URL
  6. [6]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  7. [7]
    APT40

    FireEye reporting on TEMP.Periscope (which was combined into APT40) indicated TEMP.Periscope was reported upon as Leviathan.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: FireEye APT40 March 2019)

  8. [8]
    BRONZE MOHAWK

    (Citation: CISA AA21-200A APT40 July 2021)(Citation: SecureWorks BRONZE MOHAWK n.d.)

  9. [9]
    Crowdstrike KRYPTONITE PANDA August 2018

    Adam Kozy. (2018, August 30). Two Birds, One Stone Panda. Retrieved August 24, 2021.

    Open source URL
  10. [10]
    Gadolinium

    (Citation: CISA AA21-200A APT40 July 2021)(Citation: MSTIC GADOLINIUM September 2020)

  11. [11]
    Gingham Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)

  12. [12]
    Kryptonite Panda

    (Citation: CISA AA21-200A APT40 July 2021)(Citation: Crowdstrike KRYPTONITE PANDA August 2018)

  13. [13]
    Leviathan

    (Citation: Proofpoint Leviathan Oct 2017)

  14. [14]
    MSTIC GADOLINIUM September 2020

    Ben Koehl, Joe Hannon. (2020, September 24). Microsoft Security - Detecting Empires in the Cloud. Retrieved August 24, 2021.

    Open source URL
  15. [15]
    MUDCARP

    (Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)

  16. [16]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  17. [17]
    SecureWorks BRONZE MOHAWK n.d.

    SecureWorks. (n.d.). Threat Profile - BRONZE MOHAWK. Retrieved August 24, 2021.

    Open source URL
  18. [18]
    TEMP.Jumper

    [Leviathan](https://attack.mitre.org/groups/G0065) was previously reported upon by FireEye as TEMP.Periscope and TEMP.Jumper.(Citation: CISA AA21-200A APT40 July 2021)(Citation: FireEye APT40 March 2019)

  19. [19]
    TEMP.Periscope

    [Leviathan](https://attack.mitre.org/groups/G0065) was previously reported upon by FireEye as TEMP.Periscope and TEMP.Jumper.(Citation: CISA AA21-200A APT40 July 2021)(Citation: FireEye Periscope March 2018)(Citation: FireEye APT40 March 2019)

  20. [20]
    mitre-attackG0065
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use