APT40
threat actorCNalso known as
Other names and identifiers for this entity.
ATT&CK
APT40 · BRONZE MOHAWK · Gadolinium · Gingham Typhoon · Kryptonite Panda · Leviathan · MUDCARP · TEMP.Jumper · TEMP.Periscope
MISP
APT40 · ATK29 · BRONZE MOHAWK · GADOLINIUM · Gingham Typhoon · ISLAND CASTLE · ISLANDDREAMS · ITG09 · KRYPTONITE PANDA · Leviathan · MUDCARP · Red Ladon · TA423 · TEMP.Jumper · TEMP.Periscope
Leviathan is an espionage actor targeting organizations and high-value targets in defense and government. Active since at least 2014, this actor has long-standing interest in maritime industries, naval defense contractors, and associated research institutions in the United States and Western Europe.
resolved ATT&CK groups
Threat groups associated with this.
techniques used (50)
ATT&CK techniques this enables or maps to.
campaigns (1)
Campaigns that use this.
software used (17)
Malware and tools associated with this.
references
External citations — patches, advisories, analysis.
- https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html
- https://www.cfr.org/interactive/cyber-operations/apt-40
- https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html
- https://www.recordedfuture.com/chinese-threat-actor-tempperiscope/
- https://www.fireeye.com/blog/threat-research/2018/07/chinese-espionage-group-targets-cambodia-ahead-of-elections.html
- https://attack.mitre.org/groups/G0065/
- https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/