S0228 NanHaiShu

malwareEnterprise

platformsWindows

also known asNanHaiShu

NanHaiShu is a remote access tool and JScript backdoor used by Leviathan. NanHaiShu has been used to target government and private-sector organizations that have relations to the South China Sea dispute.

techniques used (12)

ATT&CK techniques this enables or maps to.

T1016System Network Configuration Discovery
T1027.013Encrypted/Encoded File
T1033System Owner/User Discovery
T1059.005Visual Basic
T1059.007JavaScript
T1070.004File Deletion
T1071.004DNS
T1082System Information Discovery
T1105Ingress Tool Transfer
T1218.005Mshta
T1547.001Registry Run Keys / Startup Folder
T1685Disable or Modify Tools

used by groups (1)

Threat groups associated with this.

G0065Leviathan

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan