Threat group.View on attack.mitre.org
Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.
| Technique | Procedure example |
|---|---|
| T1003 OS Credential Dumping |
Leviathan has used publicly available tools to dump password hashes, including HOMEFRY. |
| T1003.001 LSASS Memory |
Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE. |
| T1021.001 Remote Desktop Protocol |
Leviathan has targeted RDP credentials and used it to move through the victim environment. |
| T1021.004 SSH |
Leviathan used ssh for internal reconnaissance. |
| T1027.001 Binary Padding |
Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection. |
| T1027.003 Steganography |
Leviathan has used steganography to hide stolen data inside other files stored on Github. |
| T1027.013 Encrypted/Encoded File |
Leviathan has obfuscated code using base64. |
| T1027.015 Compression |
Leviathan has obfuscated code using gzip compression. |
| T1041 Exfiltration Over C2 Channel |
Leviathan has exfiltrated data over its C2 channel. |
| T1047 Windows Management Instrumentation |
Leviathan has used WMI for execution. |
| T1055.001 Dynamic-link Library Injection |
Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim. |
| T1059.001 PowerShell |
Leviathan has used PowerShell for execution. |
| T1059.005 Visual Basic |
Leviathan has used VBScript. |
| T1074.001 Local Data Staging |
Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories. |
| T1074.002 Remote Data Staging |
Leviathan has staged data remotely prior to exfiltration. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
