FORENSIA

THREAT_ACTOR · G0065

Leviathan

Also known as: Leviathan, MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper, APT40, TEMP.Periscope, Gingham Typhoon

Profile

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.

MITRE ATT&CK ↗

Techniques

50 ATT&CK techniques attributed to this actor.

T1003 OS Credential DumpingT1003.001 LSASS MemoryT1021.001 Remote Desktop ProtocolT1021.004 SSHT1027.001 Binary PaddingT1027.003 SteganographyT1027.013 Encrypted/Encoded FileT1027.015 CompressionT1041 Exfiltration Over C2 ChannelT1047 Windows Management InstrumentationT1055.001 Dynamic-link Library InjectionT1059.001 PowerShellT1059.005 Visual BasicT1074.001 Local Data StagingT1074.002 Remote Data StagingT1078 Valid AccountsT1090.003 Multi-hop ProxyT1102.003 One-Way CommunicationT1105 Ingress Tool TransferT1133 External Remote ServicesT1140 Deobfuscate/Decode Files or InformationT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1197 BITS JobsT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1218.010 Regsvr32T1505.003 Web ShellT1534 Internal SpearphishingT1546.003 Windows Management Instrumentation Event SubscriptionT1547.001 Registry Run Keys / Startup FolderT1547.009 Shortcut ModificationT1553.002 Code SigningT1559.002 Dynamic Data ExchangeT1560 Archive Collected DataT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1567.002 Exfiltration to Cloud StorageT1572 Protocol TunnelingT1583.001 DomainsT1584.004 ServerT1584.008 Network DevicesT1585.001 Social Media AccountsT1585.002 Email AccountsT1586.001 Social Media AccountsT1586.002 Email AccountsT1587.004 ExploitsT1589.001 CredentialsT1595.002 Vulnerability Scanning

Software

17 malware/tools attributed to this actor.

Windows Credential EditorChina ChopperDerusbigh0st RATNetBLACKCOFFEEatCobalt StrikeTorBITSAdminPowerSploitNanHaiShuOrzHOMEFRYMURKYTOPEmpireBADFLICK

Related corpus activity

10,344 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Leviathan.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-22653cve—852
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2016-5681cve—852
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2021-4045cve—851
cve-2020-17456cve—851
cve-2020-22658cve—852
cve-2022-47945cve—851
cve-2025-23304cve—852
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,344.