- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, Ministry of State Security, Hainan province
- Agency named
- Hainan State Security Department, MSS, Ministry of State Security
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2013–2026
- Status
- Active
- ATT&CK
- G0065 · 50 techniques
- Sources
- 14 sources carry it
- Identifier
- GINC-APT-0007 · leviathan
ChinaWhat it is
Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Electric Panda, Kryptonite Panda
- IBM X-Force
- ITG09
- Mandiant
- APT40, APT 40, TEMP.Jumper, TEMP.Periscope
- Microsoft
- Gingham Typhoon
- MITRE ATT&CK
- G0065
- Proofpoint
- TA423
- PwC
- Red Ladon
- Secureworks
- BRONZE MOHAWK
- Thales
- ATK29
- Other names
- GADOLINIUM, ATK 29, Feverdream, Flaccid Rose, Hainan Xiandun Technology Company, ISLAND CASTLE, ISLANDDREAMS, JJDoor, Jumper Taurus, Ladon, Leviathan, APT 40, TEMP.Periscope, Leviathon, MUDCARP, Nanhaishu, Pickleworm, ScanBox
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Asia Pacific Economic Cooperation, Belgium, Cambodia, Germany, Hong Kong, Indonesia, Laos, Malaysia, Myanmar, New Zealand, Norway, Philippines, Saudi Arabia, Switzerland, Thailand, The Philippines, United Kingdom, United States, Vietnam
- Sectors
- Defense, Engineering, Government, Manufacturing, Maritime, Private sector, Research, Shipping and Logistics, Transportation
Tools
The tools and malware families the sources tie to it.
- 8.t exploit document builder
- AIRBREAK
- BADFLICK
- BITSAdmin
- BLACKCOFFEE
- Beacon
- CVE-2017-11882
- China Chopper
- Cobalt Strike
- DADJOKE
- Dadstache
- Derusbi
- Empire
- GRILLMARK
- Gh0st RAT
- HOMEFRY
- LUNCHMONEY
- Living off the Land
- MURKYTOP
- NanHaiShu
- Net
- Orz
- PHOTO
- PlugX
- PowerSploit
- RoyalRoad RTF Weaponizer
- SeDLL
- Tor
- UNITEDRAKE
- Windows Credential Editor
- Windows Credentials Editor
- ZXShell
- at
- gh0st RAT
- scanbox
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de