threat actor

Leviathan

activeentity:threat_actor

[Leviathan](https://attack.mitre.org/groups/G0065) is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, [Leviathan](https://attack.mitre.org/groups/G0065) has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, ma

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: leviathan
kind: threat actor
status: active
aliases: APT40 · BRONZE MOHAWK · Gadolinium · Gingham Typhoon · Kryptonite Panda · MUDCARP · TEMP.Jumper · TEMP.Periscope
jurisdictions: —
claims naming it: 0 · 0 attributions · 10 relations · 0 events

Identifiers

attack G0065via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatLeviathanusesHOMEFRY
fetch —sha256 dc1639caa5501d72
rel_326btcintel:relations:326@v1 sha256:74c0e22838cf6178
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesDerusbi
fetch —sha256 dc1639caa5501d72
rel_327btcintel:relations:327@v1 sha256:4c73aeb12c9bf439
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesBLACKCOFFEE
fetch —sha256 dc1639caa5501d72
rel_328btcintel:relations:328@v1 sha256:309f06ee4ee3cbe2
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_329btcintel:relations:329@v1 sha256:e6fa7ebd0ce07a00
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesMURKYTOP
fetch —sha256 dc1639caa5501d72
rel_330btcintel:relations:330@v1 sha256:1d7080ffd6c288de
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesNanHaiShu
fetch —sha256 dc1639caa5501d72
rel_331btcintel:relations:331@v1 sha256:d92308f4fa2139cd
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesOrz
fetch —sha256 dc1639caa5501d72
rel_332btcintel:relations:332@v1 sha256:f038202b8881f3a9
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_333btcintel:relations:333@v1 sha256:740518862c3d5fe4
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesChina Chopper
fetch —sha256 dc1639caa5501d72
rel_334btcintel:relations:334@v1 sha256:8c5aefa8af9d2137
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesBADFLICK
fetch —sha256 dc1639caa5501d72
rel_676btcintel:relations:676@v1 sha256:6b279c8dabec10bf
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.