APT40

🔴 High
Also known as: APT 40, APT40, ATK 29, ATK29, BRONZE MOHAWK, Bronze Mohawk, ELECTRIC PANDA, Electric Panda, Feverdream, Flaccid Rose, G0065, GADOLINIUM, Gadolinium, Gingham Typhoon, Hainan Xiandun Technology Company, ISLAND CASTLE, ISLANDDREAMS, ITG09, IslandDreams, JJDoor, Jumper Taurus, KRYPTONITE PANDA, Kryptonite Panda, Ladon, Leviathan, Leviathon, MUDCARP, Mudcarp, Nanhaishu, Pickleworm, Red Ladon, ScanBox, TA423, TEMP.Jumper, TEMP.Periscope, Temp.Jumper, Temp.Periscope

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security’s (MSS) Hainan State Security Department and an affiliated front company. CISA AA21-200A APT40 July 2021 Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia. CISA AA21-200A APT40 July 2021 Proofpoint Leviathan Oct 2017 FireEye Periscope March 2018 CISA Leviathan 2024

🌍 Country China
📅 Activity 2013 — 2024
⚡ Risk Level High
🎯 Incident Type Espionage
🧭 ATT&CK G0065
Maritime Government Defense Private sector
2013
2024

Targeted Victims

United States Hong Kong The Philippines Asia Pacific Economic Cooperation Cambodia Belgium Germany Philippines Malaysia Norway Saudi Arabia Switzerland United Kingdom

Associated Operations

2014 2017 2017-05 2018 2018-07 2020-01 2021 Employees of a U.K.-based engineering company were among the targeted victims of a spear-phishing campaign in early July 2018. The campaign also targeted an email address possibly belonging to a freelance journalist based in Cambodia who covers Cambodian politics FireEye has examined a range of TEMP.Periscope activity revealing extensive interest in Cambodia’s politics Parliamentary network breached by the PRC Proofpoint researchers are tracking an espionage actor targeting organizations and high-value targets in defense and government. Active since at least 2014 Spear-phishing maritime and defense targets TEMP.Periscope has recently re-emerged and has been observed conducting operations with a revised toolkit. Known targets of this group have been involved in the maritime industry TEMP.Periscope’s interest in the U.K. engineering company they targeted dates back to attempted intrusions in May 2017. Targeting Cambodia Ahead of July 2018 Elections Targeting UK-Based Engineering Company Using Russian APT Techniques The Malaysian Computer Emergency Response Team The current campaign is a sharp escalation of detected activity since summer 2017. Like multiple other Chinese cyber espionage actors a government-backed organization academic organizations and Chinese development. We believe both attacks used the same infrastructure as a reported campaign by Chinese threat actor TEMP.Periscope (also known as Leviathan) and associated research institutions in the United States and Western Europe. and include research institutes and private firms in the United States. as well as engineering-focused entities as well as the targeting of opposition figures. This campaign occurs in the run up to the country’s July 29 general elections. https://www.beehive.govt.nz/release/parliamentary-network-breached-prc https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html https://www.fireeye.com/blog/threat-research/2018/07/chinese-espionage-group-targets-cambodia-ahead-of-elections.html https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets https://www.recordedfuture.com/chinese-threat-actor-tempperiscope/ https://www.zdnet.com/article/malaysia-warns-of-chinese-hacking-campaign-targeting-government-projects/ human rights naval defense contractors said it had “observed an increase in [the] number of artifacts and victims involving a campaign against Malaysian government officials.” this actor has long-standing interest in maritime industries which targeted Cambodian entities in the run-up to their July 2018 elections. Crucially with active compromises of multiple Cambodian entities related to the country’s electoral system. This includes compromises of Cambodian government entities charged with overseeing the elections

Introduction

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security’s (MSS) Hainan State Security Department and an affiliated front company. CISA AA21-200A APT40 July 2021 Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia. CISA AA21-200A APT40 July 2021 Proofpoint Leviathan Oct 2017 FireEye Periscope March 2018 CISA Leviathan 2024

Activities and Tactics

Targeted Sectors: Maritime, Government, Defense, Private sector

Country of Origin: 🇨🇳 China

Risk Level: High

First Seen: 2013

Last Activity: 2024

Incident Type: Espionage

Suspected Victims: United States, Hong Kong, The Philippines, Asia Pacific Economic Cooperation, Cambodia, Belgium, Germany, Philippines, Malaysia, Norway…

Notable Campaigns

  • Leviathan Australian Intrusions (C0049): Leviathan Australian Intrusions consisted of at least two long-term intrusions against victims in Australia by Leviathan, relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. Leviathan Australian Intrusions were focused on exfiltrating sensitive data including valid credentials for the victim organizations.(Citation: CISA Leviathan 2024)

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 3 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • UNITEDRAKE
  • AIRBREAK:
  • BADFLICK:
  • PHOTO:
  • HOMEFRY:
  • LUNCHMONEY:
  • MURKYTOP:
  • China Chopper:
  • Beacon:
  • BLACKCOFFEE:
  • CVE-2017-11882:
  • Derusbi:
  • RoyalRoad RTF Weaponizer:
  • 8.t exploit document builder:
  • Cobalt Strike:
  • DADJOKE:
  • Dadstache:
  • GRILLMARK:
  • Gh0st RAT:
  • Living off the Land:
  • NanHaiShu:
  • PlugX:
  • SeDLL:
  • Windows Credentials Editor:
  • ZXShell:
  • scanbox:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [10] Accenture MUDCARP March 2019 Accenture iDefense Unit. (2019, March 5). Mudcarp’s Focus on Submarine Technologies. Retrieved August 24, 2021. [11] Crowdstrike KRYPTONITE PANDA August 2018 Adam Kozy. (2018, August 30). Two Birds, One Stone Panda. Retrieved August 24, 2021. [12] Proofpoint Leviathan Oct 2017 Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018. [13] MSTIC GADOLINIUM September 2020 Ben Koehl, Joe Hannon. (2020, September 24). Microsoft Security - Detecting Empires in the Cloud. Retrieved August 24, 2021. [14] CISA Leviathan 2024 CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025. [15] CISA AA21-200A APT40 July 2021 CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021. [17] FireEye Periscope March 2018 FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018. [18] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [19] FireEye APT40 March 2019 Plan, F., et al. (2019, March 4). APT40: Examining a China-Nexus Espionage Actor. Retrieved March 18, 2019. [20] SecureWorks BRONZE MOHAWK n.d. SecureWorks. (n.d.). Threat Profile - BRONZE MOHAWK. Retrieved August 24, 2021.