Leviathan
IntrusionSet · ATTACK:enterprise:G0065
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0065",
"title": "Leviathan",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0065",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--7113eaa5-ba79-4fb3-b68a-398ee9cd698e",
"external_id": "G0065",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2026-07-31T20:48:37.749Z",
"version": "4.1",
"aliases": [
"Leviathan",
"MUDCARP",
"Kryptonite Panda",
"Gadolinium",
"BRONZE MOHAWK",
"TEMP.Jumper",
"APT40",
"TEMP.Periscope",
"Gingham Typhoon"
],
"tactics": [
],
"source_references": [
{
"source_name": "MUDCARP"
},
{
"source_name": "Kryptonite Panda"
},
{
"source_name": "Gadolinium"
},
{
"source_name": "BRONZE MOHAWK"
},
{
"source_name": "Gingham Typhoon"
},
{
"source_name": "Leviathan"
},
{
"source_name": "TEMP.Jumper"
},
{
"source_name": "TEMP.Periscope"
},
{
"source_name": "Accenture MUDCARP March 2019",
"url": "https://www.accenture.com/us-en/blogs/cyber-defense/mudcarps-focus-on-submarine-technologies"
},
{
"source_name": "Crowdstrike KRYPTONITE PANDA August 2018",
"url": "https://www.crowdstrike.com/blog/two-birds-one-stone-panda/"
},
{
"source_name": "Proofpoint Leviathan Oct 2017",
"url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"
},
{
"source_name": "MSTIC GADOLINIUM September 2020",
"url": "https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/"
},
{
"source_name": "CISA Leviathan 2024",
"url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"
},
{
"source_name": "CISA AA21-200A APT40 July 2021",
"url": "https://us-cert.cisa.gov/ncas/alerts/aa21-200a"
},
{
"source_name": "APT40"
},
{
"source_name": "FireEye Periscope March 2018",
"url": "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "FireEye APT40 March 2019",
"url": "https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"
},
{
"source_name": "SecureWorks BRONZE MOHAWK n.d.",
"url": "https://www.secureworks.com/research/threat-profiles/bronze-mohawk"
}
]
}Explicit source assertions (68)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--035e7890-593f-4f70-898a-93f3302f8fac
Proofpoint Leviathan Oct 2017 · FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1595.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17a16ae3-ee83-461b-aa3a-7904415f2e62
CISA Leviathan 2024ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1102.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cabd067-2229-488f-a244-03aa087b7e54
FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23d208f5-cadc-4f80-94c4-5644eaa8b7c7
Proofpoint Leviathan Oct 2017ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24879d15-1ec3-437c-bdc5-5b7ac46bb4f5
FireEye APT40 March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25e695b0-1110-43ab-be79-5e89e3951759
FireEye APT40 March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--273ad96c-269f-4736-a3de-646713c15b50
Proofpoint Leviathan Oct 2017 · FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2851e8fa-0622-42db-b7b7-4e051fc5fbeb
Proofpoint Leviathan Oct 2017 · FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c7d090e-09a1-4a45-baf4-b13790b483f6
Proofpoint Leviathan Oct 2017ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1589.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2de94367-a058-4a31-b19b-fddebe02ca64
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31a8dc85-abb8-4144-9fe8-6d9a71339c0e
FireEye APT40 March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1586.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--339b895c-48fa-4f99-9266-4310aeeb040f
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3964d326-01f2-4142-8f41-408f576b53b4
FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c4401bf-7a45-4d1d-a4ee-ea00788cd2aa
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41bbe151-0ebe-4610-85d2-ba565e299d23
Proofpoint Leviathan Oct 2017ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0232
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44add639-84c1-45e7-a640-bcc3ac2b12e1
FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f223b45-a599-4f97-9932-edfdc4425fde
Accenture MUDCARP March 2019 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fe3f0a3-1330-4b51-be17-b38a54b6e605
FireEye Periscope March 2018 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bbeba86-0f26-4c02-9c66-8118ad6c0208
FireEye APT40 March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cc7c5ef-f170-4147-8703-03ea34d40d12
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61f91f23-a8a5-4b4e-b546-f0fff28851a1
Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0069
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67003297-a35d-452f-b83b-34556115d15c
FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1189
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67b0c62c-ce4f-4e08-8d8c-9e1fd4afe255
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b2cd244-a02f-4b76-85d9-a429a298f016
FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c9ed67e-95f1-4585-8d8d-14a27f21e14c
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0642
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cccc84e-8b42-444c-8d18-12628b0e353c
Accenture MUDCARP March 2019 · FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1585.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6de233bc-efe2-4dbd-b0a6-994d45f6bc23
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71ae6f80-3d5c-4d61-8995-5844f9f592ed
Accenture MUDCARP March 2019 · Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021 · FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1547.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--728dce0a-125c-4d66-8622-36d4d909352b
Proofpoint Leviathan Oct 2017 · FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0363
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--732d754a-b02d-4ec6-8ba2-364c3a8510de
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7995952f-370f-4514-a0c1-ce160b4c90c1
Accenture MUDCARP March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a64af0b-aebe-47d1-9f96-ef0ecad52df9
Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0032
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a705189-ab75-428c-ae52-b70bc0d17624
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8191e3f4-df01-42c0-925b-0038772afb17
CISA Leviathan 2024ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--829ec8ab-3e48-442b-beb2-b0d2dbdaaca0
Accenture MUDCARP March 2019 · Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021 · FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86f6e11c-759b-438d-9f32-004708c68f2c
FireEye APT40 March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88898d14-9313-4fdd-8ef5-584d8dcdec17
Proofpoint Leviathan Oct 2017ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90268df8-948a-4eb4-a21c-7b1c6808f669
Accenture MUDCARP March 2019 · CISA Leviathan 2024 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:C0049 → attributed-to → ATTACK:enterprise:G0065
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--920874f2-f1e1-4981-9469-4ee45b6218a7
CISA Leviathan 2024ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9493cec9-dbbc-43ef-ae57-6f307f8d6001
FireEye Periscope March 2018 · FireEye APT40 March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0194
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--962f1bc9-89f8-4fbe-b981-b63cce196cbf
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad4a2d0b-a268-4334-903c-153858088138
Accenture MUDCARP March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1587.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b34ac4fc-95fc-4ebb-9d83-f94de511a775
CISA Leviathan 2024ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1197
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5894858-3f86-48f4-8ae0-7fcb8c19c36b
FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7d36798-e9f2-4474-836e-80b100a561e6
FireEye Periscope March 2018 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b979ce29-9d89-4d81-82fb-14240af7a241
Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb870870-2dfb-4ff3-9e17-6a75476d9be4
Proofpoint Leviathan Oct 2017ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1074.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bbd420ed-6959-4190-8317-2b9ecdc32856
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0233
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcdf2779-c5a2-40b3-88b6-0857711c1cfe
FireEye Periscope March 2018 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c00b008a-5f2c-4837-811b-21193b70b4ae
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c010891f-9ddb-4943-a87a-e83c46075406
CISA Leviathan 2024ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c334b4c6-43f1-4452-8a1f-3d056fba9ac0
Proofpoint Leviathan Oct 2017ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd46796f-4a71-468a-b19f-87a13894d254
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0cd2d2a-3a74-488b-8227-00e32ed12291
CISA Leviathan 2024 · CISA AA21-200A APT40 July 2021 · FireEye APT40 March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0228
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d26e2b47-e474-402d-b3ff-423a8b64a68e
Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4c15cb6-ed2f-4ed0-8e6d-dd69e06c3c3f
FireEye APT40 March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0229
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5599a7e-d6a4-4de7-918a-84c3972c21ef
Accenture MUDCARP March 2019 · Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0154
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8cbc56c-4014-4e59-adfd-1899859f01d4
Proofpoint Leviathan Oct 2017 · FireEye Periscope March 2018 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1584.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db35390e-63b3-4cf7-8c44-dab132883810
CISA Leviathan 2024ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3189323-c5f2-46c4-8912-36a09f3317ad
Proofpoint Leviathan Oct 2017ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e37d3456-b3a0-4502-b502-a505f383cb4c
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb3a34dd-c516-44a6-9268-6464016bd14a
Accenture MUDCARP March 2019 · CISA AA21-200A APT40 July 2021 · FireEye Periscope March 2018ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0183
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec9a7e1d-53f8-4a79-a5dd-a5890bf421ba
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f71fa9f5-7a3c-43a7-8ca3-2e3c8996bde8
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f81ae9dc-3299-480f-817c-a5b65cfc38d7
Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa6bb182-28e8-4293-90ba-ee9a5c23d45b
CISA AA21-200A APT40 July 2021ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbcd00ef-0518-414d-9026-b736f036606a
FireEye APT40 March 2019ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe4a20ca-7a57-44b7-bcf3-0f51fe9abffa
CISA AA21-200A APT40 July 2021