Leviathan

Overview

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.

Naming & attribution

Leviathan is tracked under 9 names across the industry. It uses 50 documented ATT&CK techniques — more than 84% of the 174 groups tracked here. Activity attributed since at least 2009.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1102.003 One-Way Communication — used by 2 of 174 groups
• T1586.001 Social Media Accounts — used by 2 of 174 groups
• T1587.004 Exploits — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• APT39 Iran — 21 shared techniques (26% overlap)
• Threat Group-3390 China — 20 shared techniques (23% overlap)
• Patchwork — 17 shared techniques (23% overlap)
• WIRTE — 14 shared techniques (23% overlap)
• APT28 Russia — 26 shared techniques (22% overlap)
• Lazarus Group North Korea — 25 shared techniques (21% overlap)

Targets

Government · Private sector

Regions

Asia Pacific Economic Cooperation · Belgium · Cambodia · Germany · Hong Kong · Malaysia · Norway · Philippines · Saudi Arabia · Switzerland · The Philippines · United Kingdom · United States

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190, T1203
• Custom malware/implant development — ATT&CK: 10 attributed custom malware families

TTPs — 50 techniques across 13 tactics

Tools & malware (17)

Windows Credential Editor · BITSAdmin · HOMEFRY · Derusbi · at · BLACKCOFFEE · BADFLICK · Empire · gh0st RAT · Net · PowerSploit · MURKYTOP · NanHaiShu · Orz · Cobalt Strike · China Chopper · Tor

Reporting (3)

• People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action — CISA et al
• How Microsoft names threat actors — Microsoft
• (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department — CISA