G0065 Nation-stateour call,
not MITRE’s ATT&CK Group

Leviathan

How MITRE ATT&CK characterizes this group¹: Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle…

Origin / sponsor: not established from a curated public advisory — see Coverage & confidence. Not asserted here.

Also tracked as: MUDCARP Kryptonite Panda Gadolinium BRONZE MOHAWK TEMP.Jumper APT40 TEMP.Periscope Gingham Typhoon — ATT&CK group page¹

Read this as · tier is our editorial call, not MITRE’s

Read as a state-directed operator, not a smash-and-grab.

A nation-state classification means patience, tradecraft, and an intelligence objective. When this name attaches to a vulnerability, the question shifts from “will someone exploit it” to “has a well-resourced service already built it into an operation.” All tradecraft below is sourced to MITRE ATT&CK.

Techniques

ATT&CK count¹

Named tools / malware

ATT&CK count²

Attributed campaigns

ATT&CK count¹

Tactics spanned

ATT&CK count¹

~2022–2022approx.

Activity bounds (campaign floor)

approximate¹

Known for

— signature moves, each sourced to ATT&CK

CampaignLeviathan Australian Intrusions. ATT&CK tracks this attributed operation as C0049.⁷⁰

ArsenalNamed tooling. ATT&CK attributes 17 tools/malware to this group, including Windows Credential Editor, China Chopper, Derusbi, gh0st RAT.⁵³

ReachFurthest outcome. This actor's cited tradecraft reaches as far as outcome 4 — Data at risk — exfiltration. (editorial mapping over ATT&CK tactics).

Tradecraft heatmap

— ATT&CK techniques mapped onto the five attacker-outcome narratives

Each row is a documented technique (MITRE ATT&CK). Each column is one of the five attacker-outcome narratives a defender funds against. A filled cell means this technique’s own ATT&CK tactic defensibly advances that outcome. The mapping of technique→outcome is our editorial alignment over ATT&CK's tactic data, not a separately-sourced MITRE edge. A filled cell means one of the technique's own ATT&CK tactics defensibly advances that outcome; enabler tactics (C2, Defense Evasion, Discovery) heat no column.

1Front door

2Keys to the kingdom

3Lateral reach

4Data at risk

5Lights out

T1003 OS Credential DumpingCredential Access

●

T1003.001 LSASS MemoryCredential Access

●

T1021.001 Remote Desktop ProtocolLateral Movement

●

T1021.004 SSHLateral Movement

●

T1027.001 Binary PaddingDefense Evasion

T1027.003 SteganographyDefense Evasion

T1027.013 Encrypted/Encoded FileDefense Evasion

T1027.015 CompressionDefense Evasion

T1041 Exfiltration Over C2 ChannelExfiltration

●

T1047 Windows Management InstrumentationExecution

●

T1055.001 Dynamic-link Library InjectionPrivilege Escalation / Defense Evasion

●

T1059.001 PowerShellExecution

●

T1059.005 Visual BasicExecution

●

T1074.001 Local Data StagingCollection

●

T1074.002 Remote Data StagingCollection

●

T1078 Valid AccountsInitial Access / Persistence / Privilege Escalation / Defense Evasion

●

T1090.003 Multi-hop ProxyCommand & Control

T1102.003 One-Way CommunicationCommand & Control

T1105 Ingress Tool TransferCommand & Control

T1133 External Remote ServicesInitial Access / Persistence

●

T1140 Deobfuscate/Decode Files or InformationDefense Evasion

T1189 Drive-by CompromiseInitial Access

●

T1190 Exploit Public-Facing ApplicationInitial Access

●

T1197 BITS JobsPersistence / Defense Evasion

●

T1203 Exploitation for Client ExecutionExecution

●

T1204.001 Malicious LinkExecution

●

T1204.002 Malicious FileExecution

●

T1218.010 Regsvr32Defense Evasion

T1505.003 Web ShellPersistence

●

T1534 Internal SpearphishingLateral Movement

●

T1546.003 Windows Management Instrumentation Event SubscriptionPersistence / Privilege Escalation

●

T1547.001 Registry Run Keys / Startup FolderPersistence / Privilege Escalation

●

T1547.009 Shortcut ModificationPersistence / Privilege Escalation

●

T1553.002 Code SigningDefense Evasion

T1559.002 Dynamic Data ExchangeExecution

●

T1560 Archive Collected DataCollection

●

T1566.001 Spearphishing AttachmentInitial Access

●

T1566.002 Spearphishing LinkInitial Access

●

T1567.002 Exfiltration to Cloud StorageExfiltration

●

T1572 Protocol TunnelingCommand & Control

T1583.001 DomainsResource Development

T1584.004 ServerResource Development

T1584.008 Network DevicesResource Development

T1585.001 Social Media AccountsResource Development

T1585.002 Email AccountsResource Development

T1586.001 Social Media AccountsResource Development

T1586.002 Email AccountsResource Development

T1587.004 ExploitsResource Development

T1589.001 CredentialsReconnaissance

T1595.002 Vulnerability ScanningReconnaissance

Reach: this actor’s cited techniques light columns 1·2·3·4 — furthest is 4 · Data at risk. (furthest-position idiom, reused from the landing map).

A dot = this technique advances that outcomeColumn 5 (Lights out) is empty — Compare: a ransomware or wiper actor lights column 5.

Editorial: the technique→outcome alignment is our call over ATT&CK’s tactic data, not a separately-sourced MITRE edge — same basis the landing page declares. Enabler tactics (C2, defense evasion, discovery) heat no column.¹

Arsenal

— named tools & malware ATT&CK attributes to this group

Windows Credential EditorS0005 · Tool

ATT&CK S0005 ↗

China ChopperS0020 · Malware

ATT&CK S0020 ↗

DerusbiS0021 · Malware

ATT&CK S0021 ↗

gh0st RATS0032 · Malware

ATT&CK S0032 ↗

NetS0039 · Tool

ATT&CK S0039 ↗

BLACKCOFFEES0069 · Malware

ATT&CK S0069 ↗

atS0110 · Tool

ATT&CK S0110 ↗

Cobalt StrikeS0154 · Malware

ATT&CK S0154 ↗

+9 moreCoverage

ATT&CK attributes 17 tools/malware to G0065 in total; the full list is on the group page.

ATT&CK G0065 ↗

Campaign highlights

— attributed operations in the ATT&CK record

Leviathan Australian Intrusions — ATT&CK Campaign C0049

Attributed operation

ATT&CK records Leviathan Australian Intrusions (C0049) — roughly 2022–2022 as an operation attributed to this group.⁷⁰

Open ATT&CK C0049 ↗

Latest activity

— with explicit confidence, and what we cannot yet claim

ATT&CK
snapshot

The most recent cited activity in this card is the ATT&CK record itself. We do not paste a “last seen this week” line we cannot source. Recency from secondary reporting appears here only when attached to a named advisory.

ATT&CK snapshot, compiled 2026-06-22Coverage gap — live “currently active” status not asserted

CVE ↔ actor bridge — Known exploits / Linked CVEs every link below traces to a named source; tier is explicit

Known exploits — confirmed by named advisory 5 CVE(s)

CVE-2021-31207 →

The CISA-led joint advisory AA24-190A names APT40 (tracked in ATT&CK as Leviathan) as a PRC Ministry of State Security group that rapidly weaponizes newly public vulnerabilities, naming the ProxyShell Exchange chain, Log4Shell, and Atlassian Confluence CVEs alongside the group.

CISA AA24-190A — names this group + CVE ↗

CVE-2021-34523 →

CISA AA24-190A — names this group + CVE ↗

CVE-2021-34473 →

CISA AA24-190A — names this group + CVE ↗

CVE-2021-44228 →

CISA AA24-190A — names this group + CVE ↗

CVE-2021-26084 →

CISA AA24-190A — names this group + CVE ↗

Inferred / reported — lower confidence, never headline attribution 1 link(s)

These are not confirmed attribution. An inferred link is a structural ATT&CK chain (this group uses a tool whose reference cites the CVE); it is back-cited to the original report and never claims the source names the group.

CVE-2015-5119 →

ATT&CK attributes gh0st RAT (S0032) to this group, and that software’s ATT&CK reference cites CVE-2015-5119. Structural chain — not a statement that the report names the group.

original report (cited on the ATT&CK software page) ↗

Coverage & confidence

— what we know, and what we don’t

Established (cited)

Group identity, aliases, description — MITRE ATT&CK group page

50 techniques — ATT&CK technique pages (linked per row)

17 software (arsenal) — ATT&CK software pages

1 attributed campaign(s) — ATT&CK campaign pages

10 third-party research citations — ATT&CK external references

Coverage gaps — stated, not hidden

Origin/sponsor not established from a curated public advisory. ATT&CK prose may imply attribution but is not asserted here — absence of a curated source is a coverage finding, not a clean bill of attribution.

Threat tier is OUR editorial classification (rule-based), not a MITRE field — labeled as such.

Technique → outcome heatmap is editorial alignment over ATT&CK tactic data, not a separately-sourced MITRE edge.

Activity bounds are a floor from attributed-campaign dates only — flagged approx., not a true active-since range.

ATT&CK has no first-class group→CVE relationship; this card asserts no specific CVE without a named advisory.

Empty heatmap column(s): Lights out — consistent with this actor's nature, stated as a finding.