APT40Threat actor
- atk29
- bronze mohawk
- g0065
- gadolinium
- gingham typhoon
- island castle
- islanddreams
- itg09
- kryptonite panda
- leviathan
- mudcarp
- red ladon
- ta423
- temp.jumper
- temp.periscope
Leviathan is an espionage actor targeting organizations and high-value targets in defense and government. Active since at least 2014, this actor has long-standing interest in maritime industries, naval defense contractors, and associated research institutions in the United States and Western Europe.From MISP Galaxy
Last reported 4 years ago, by Elastic Security Labs2 reports
ATT&CK techniques
6 of 12 · each with the sentence it comes from- T1036Masquerading
“This variant utilizes a .vbs dropper by masquerading as a .doc file, as Windows still hides the original filename extension by default.”
- T1047Windows Management Instrumentation
“Finally, it examined a popular technique used by adversaries to maintain persistence, Windows Management Instrumentation (WMI) Event Subscription (T1084).”
- T1053Scheduled Task/Job
“In this post, we’ll explore two additional persistence techniques that are being used by attackers in the wild: Scheduled Tasks (T1053) and BITS Jobs (T1197).”
- T1053.005Scheduled Task
“In this post, we’ll explore two additional persistence techniques that are being used by attackers in the wild: Scheduled Tasks (T1053) and BITS Jobs (T1197).”
- T1055Process Injection
“T1055 - Process Injection”
- T1059Command and Scripting Interpreter
“T1059 - Command-Line Interface”
What the reports say
2 reports, newest first · the exact sentence from each-
A close look at the advanced techniques used in a Malaysian-focused APT campaign“…ared tactics, techniques, and procedures (TTPs), the team assessed this activity to be possibly linked to a Chinese-based group known as APT40, or Leviathan.”
-
Adversary tradecraft 101: Hunting for persistence using Elastic Security (Part 2)“Threat groups like APT40 and malware families such as the Qbot banking trojan have used BITS to transfer malicious files and set up persistence.”
Indicators in its reports
named in the reports above- hxxps://raw.githubusercontent[.]com/3gstudent/SCTPersistence/master/calc.sctin 1 report
- 850a163ce1f9cff0367854038d8cfa7ein 1 report
- b5a5dc78fb392fae927e9461888f354din 1 report
- ccbdda7217ba439dfb6bbc6c3bd594f8in 1 report
- dbfa006d64f39cde78b0efda1373309cin 1 report
- hxxps://armybar.hopto[.]org/LogiMail.dllin 1 report
- armybar.hopto[.]orgin 1 report
- hxxps://armybar.hopto[.]org/LogiMailApp.exein 1 report
- hxxps://armybar.hopto[.]org/Encryptedin 1 report
- hxxp://tomema.myddns[.]me/postloginin 1 report
- tomema.myddns[.]mein 1 report
- hxxp://tomema.myddns[.]me/list_directionin 1 report
- hxxp://tomema.myddns[.]me/post_documentin 1 report
- 104.248.148[.]156in 1 report
- 139.59.31[.]188in 1 report
- 74b5e317527c9353…1da92a56012ain 1 report
- 523cbdaf31ddc920…74105d4f72a1in 1 report
- ab541df861c6045a…871b62ecdda7in 1 report
- 145daf50aefb7bee…4409c1e8fa30in 1 report
- 93810c5fd9a287d8…486d259810c8in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.