Leviathan

Overview

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.

Targets

Government · Private sector

Regions

Asia Pacific Economic Cooperation · Belgium · Cambodia · Germany · Hong Kong · Malaysia · Norway · Philippines · Saudi Arabia · Switzerland · The Philippines · United Kingdom · United States

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190, T1203
• Custom malware/implant development — ATT&CK: 10 attributed custom malware families

TTPs — 50 techniques across 13 tactics

Tools & malware (17)

Windows Credential Editor · BITSAdmin · HOMEFRY · Derusbi · at · BLACKCOFFEE · BADFLICK · Empire · gh0st RAT · Net · PowerSploit · MURKYTOP · NanHaiShu · Orz · Cobalt Strike · China Chopper · Tor

Reporting (3)

• People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action — CISA et al
• How Microsoft names threat actors — Microsoft
• (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department — CISA