Leviathan
MITREUnknown
Unknown
Unknown
[Leviathan](https://attack.mitre.org/groups/G0065) is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, [Leviathan](https://attack.mitre.org/groups/G0065) has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: CISA Leviathan 2024)
Techniques Used (50)
| ID | ATT&CK | Tactics |
|---|---|---|
| T1003 | OS Credential Dumping | - |
| T1003.001 | LSASS Memory | - |
| T1021.001 | Remote Desktop Protocol | - |
| T1021.004 | SSH | - |
| T1027.001 | Binary Padding | - |
| T1027.003 | Steganography | - |
| T1027.013 | Encrypted/Encoded File | - |
| T1027.015 | Compression | - |
| T1041 | Exfiltration Over C2 Channel | - |
| T1047 | Windows Management Instrumentation | - |
| T1055.001 | Dynamic-link Library Injection | - |
| T1059.001 | PowerShell | - |
| T1059.005 | Visual Basic | - |
| T1074.001 | Local Data Staging | - |
| T1074.002 | Remote Data Staging | - |
Aliases (832)
Related Malware (17)
Metadata
| ID: | 892 |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 04:00 |