CVE Intelligence
Início / Grupos de ameaça / Leviathan

Leviathan G0065

🔔 Criar alerta

Também conhecido como: MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper, APT40, TEMP.Periscope, Gingham Typhoon

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

3
CVEs associadas
60
Técnicas
17
Malwares e ferramentas

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2017-8759 Alta · 7.8 KEV Microsoft .NET Framework Remote Code Execution Vulnerability
“Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.”
CVE-2017-11882 Alta · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability
“Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.”
CVE-2017-0199 Alta · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.”

Técnicas por tática

Reconhecimento
T1589.001 CredentialsT1595.002 Vulnerability Scanning
Desenvolvimento de recursos
T1583.001 DomainsT1584.004 ServerT1584.008 Network DevicesT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.001 Social Media AccountsT1586.002 Email AccountsT1587.004 Exploits
Acesso inicial
T1078 Valid AccountsT1133 External Remote ServicesT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execução
T1047 Windows Management InstrumentationT1059.001 PowerShellT1059.005 Visual BasicT1197 BITS JobsT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1559.002 Dynamic Data Exchange
Persistência
T1078 Valid AccountsT1133 External Remote ServicesT1197 BITS JobsT1505.003 Web ShellT1546.003 Windows Management Instrumentation Event SubscriptionT1547.001 Registry Run Keys / Startup FolderT1547.009 Shortcut Modification
Escalada de privilégios
T1055.001 Dynamic-link Library InjectionT1078 Valid AccountsT1546.003 Windows Management Instrumentation Event SubscriptionT1547.001 Registry Run Keys / Startup FolderT1547.009 Shortcut Modification
Furtividade
T1027.001 Binary PaddingT1027.003 SteganographyT1027.013 Encrypted/Encoded FileT1027.015 CompressionT1055.001 Dynamic-link Library InjectionT1078 Valid AccountsT1140 Deobfuscate/Decode Files or InformationT1197 BITS JobsT1218.010 Regsvr32
Comprometimento de defesas
T1553.002 Code Signing
Acesso a credenciais
T1003 OS Credential DumpingT1003.001 LSASS Memory
Movimento lateral
T1021.001 Remote Desktop ProtocolT1021.004 SSHT1534 Internal Spearphishing
Coleta
T1074.001 Local Data StagingT1074.002 Remote Data StagingT1560 Archive Collected Data
Comando e controle
T1090.003 Multi-hop ProxyT1102.003 One-Way CommunicationT1105 Ingress Tool TransferT1572 Protocol Tunneling
Exfiltração
T1041 Exfiltration Over C2 ChannelT1567.002 Exfiltration to Cloud Storage

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.