CVE Intelligence
Home / Threat actors / Leviathan

Leviathan G0065

🔔 Create alert

Also known as: MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper, APT40, TEMP.Periscope, Gingham Typhoon

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

3
associated CVEs
60
Techniques
17
Malware and tools

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2017-8759 High · 7.8 KEV Microsoft .NET Framework Remote Code Execution Vulnerability
“Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.”
CVE-2017-11882 High · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.”
CVE-2017-0199 High · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.”

Techniques by tactic

Reconnaissance
T1589.001 CredentialsT1595.002 Vulnerability Scanning
Resource Development
T1583.001 DomainsT1584.004 ServerT1584.008 Network DevicesT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.001 Social Media AccountsT1586.002 Email AccountsT1587.004 Exploits
Initial Access
T1078 Valid AccountsT1133 External Remote ServicesT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execution
T1047 Windows Management InstrumentationT1059.001 PowerShellT1059.005 Visual BasicT1197 BITS JobsT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1559.002 Dynamic Data Exchange
Persistence
T1078 Valid AccountsT1133 External Remote ServicesT1197 BITS JobsT1505.003 Web ShellT1546.003 Windows Management Instrumentation Event SubscriptionT1547.001 Registry Run Keys / Startup FolderT1547.009 Shortcut Modification
Privilege Escalation
T1055.001 Dynamic-link Library InjectionT1078 Valid AccountsT1546.003 Windows Management Instrumentation Event SubscriptionT1547.001 Registry Run Keys / Startup FolderT1547.009 Shortcut Modification
Stealth
T1027.001 Binary PaddingT1027.003 SteganographyT1027.013 Encrypted/Encoded FileT1027.015 CompressionT1055.001 Dynamic-link Library InjectionT1078 Valid AccountsT1140 Deobfuscate/Decode Files or InformationT1197 BITS JobsT1218.010 Regsvr32
Defense Impairment
T1553.002 Code Signing
Credential Access
T1003 OS Credential DumpingT1003.001 LSASS Memory
Lateral Movement
T1021.001 Remote Desktop ProtocolT1021.004 SSHT1534 Internal Spearphishing
Collection
T1074.001 Local Data StagingT1074.002 Remote Data StagingT1560 Archive Collected Data
Command and Control
T1090.003 Multi-hop ProxyT1102.003 One-Way CommunicationT1105 Ingress Tool TransferT1572 Protocol Tunneling
Exfiltration
T1041 Exfiltration Over C2 ChannelT1567.002 Exfiltration to Cloud Storage

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.