← All actors Recent activity

Leviathan G0065

MUDCARP · TEMPPERISCOPE · apt-c-40 · apt40 · leviathan · periscope

Indicators
73
Source reports
16
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02
20182022

Overview 73 indicators

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.

domain62G0065-domain.txt
url7G0065.json
url_path4G0065.json

Techniques 50 ATT&CK

Open in ATT&CK Navigator → or download the layer (50 techniques, layer 4.5)

Software 17

Principal sources 16 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

  • APT41 G0096
    shares Derusbi, BLACKCOFFEE, BITSAdmin and 1 more
  • BRONZE BUTLER G0060
    shares at, Windows Credential Editor
  • Threat Group-3390 G0027
    shares Windows Credential Editor, China Chopper
  • APT28 G0007
    shares Tor
  • APT29 G0016
    shares Tor
  • APT17 G0025
    shares BLACKCOFFEE

Timeline 73 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 6 domain, 1 url, 3 url_path4 yrs ago

    proofpoint.com/us/blog/threat-insight/chasing-currents… · virustotal.com/gui/ip-address/139.59.60.116/relations

    domainaustralianmorningnews.com
    domainheraldsun.me
    domainimage.australianmorningnews.com
    domainregionail.xyz
    domaintheaustralian.in
    domainwalmartsde.com
    urlhttp://172.105.114.27
    url_path/?cwhe18nc
    url_path/cwhe18nc.htm
    url_path/cwhe18nc.js

  2. 1 domain4 yrs ago

    github.com/ti-research-io/ti/blob/main/ioc_extende…

    rninhsss.com

  3. 20 domain4 yrs ago

    otx.alienvault.com/pulse/61b2290ee7cb4628d56979d5

    api.dreamsbottle.com
    appexistence.com
    bbranchs.com
    cankerscarcass.com
    cdn.aexhausts.com
    cm.musicandfile.com
    dexercisep.com
    duutsxlydw.com
    guardggg.com
    iherlvufjknw.com
    ja.iherlvufjknw.com
    laodailylive.com
    laodata.network
    laodiplomat.com
    laotranslations.com
    manaloguek.com
    musicandfile.com
    news.duutsxlydw.com
    office.duutsxlydw.com
    ttxs.aexhausts.com

  4. 2 domain4 yrs ago

    otx.alienvault.com/pulse/61b2290ee7cb4628d56979d5

    networkslaoupdate.com
    news.networkslaoupdate.com

  5. 16 domain5 yrs ago

    us-cert.cisa.gov/ncas/alerts/aa21-200a · otx.alienvault.com/pulse/60f597533e911956a673717b

    cnnzapmeta.com
    goo2k88yyh2.chickenkiller.com
    katy197.chickenkiller.com
    mail2.ignorelist.com
    microsql-update.info
    mihybb.com
    nmw4xhipveaca7hm.onion.link
    porndec143.chickenkiller.com
    soure7788.chickenkiller.com
    teledynegroup.com
    testdomain2019.chickenkiller.com
    togetno992.mooo.com
    tojenner97.chickenkiller.com
    vser.mooo.com
    xbug.uk.to
    yorkshire-espana-sa.com

  6. 2 domain6 yrs ago

    elastic.co/fr/blog/advanced-techniques-used-in-mal… · otx.alienvault.com/pulse/5efa1262602caffb4ac35148

    armybar.hopto.org
    tomema.myddns.me

  7. 6 domain, 6 url6 yrs ago

    medium.com/@Sebdraven/apt-40-in-malaysia-61ed9c964… · twitter.com/ClearskySec/status/1110941178231484417 · otx.alienvault.com/pulse/5e3dbad21b45e958a0d9e5a6

    domainbyfleur.myftp.org
    domaincapitana.onthewifi.com
    domaindynamics.ddnsking.com
    domainkulkarni.bounceme.net
    domainthestar.serveblog.net
    domainvvavesltd.servebeer.com
    urlhttp://139.162.44.81
    urlhttp://152.89.161.5
    urlhttp://159.65.197.248
    urlhttp://167.99.72.82
    urlhttp://195.12.50.168
    urlhttp://207.148.79.152

  8. 1 domain7 yrs ago

    twitter.com/Vishnyak0v/status/1203986670623887361 · medium.com/@Sebdraven/apt-40-in-malaysia-61ed9c964… · twitter.com/ClearskySec/status/1110941178231484417 · otx.alienvault.com/pulse/5e3dbad21b45e958a0d9e5a6

    accountsx.bounceme.net

  9. 1 domain7 yrs ago

    otx.alienvault.com/pulse/5ca740c67a9dbc78fe32f9b9 · accenture.com/t20190305T200954Z__w__/us-en/_acnmedia/… · us-cert.cisa.gov/ncas/alerts/aa21-200a · otx.alienvault.com/pulse/60f597533e911956a673717b

    wsmcoff.com

  10. 1 domain7 yrs ago

    otx.alienvault.com/pulse/5ca740c67a9dbc78fe32f9b9 · accenture.com/t20190305T200954Z__w__/us-en/_acnmedia/…

    eujinonline.sytes.net

  11. 1 url_path7 yrs ago

    proofpoint.com/us/blog/threat-insight/chasing-currents… · virustotal.com/gui/ip-address/139.59.60.116/relations

    /D2_de2o@sp0/

  12. 1 domain8 yrs ago

    otx.alienvault.com/pulse/5ca740c67a9dbc78fe32f9b9 · accenture.com/t20190305T200954Z__w__/us-en/_acnmedia/… · us-cert.cisa.gov/ncas/alerts/aa21-200a · otx.alienvault.com/pulse/60f597533e911956a673717b · recordedfuture.com/chinese-threat-actor-tempperiscope

    thyssenkrupp-marinesystems.org

  13. 1 domain8 yrs ago

    us-cert.cisa.gov/ncas/alerts/aa21-200a · otx.alienvault.com/pulse/60f597533e911956a673717b

    thestar.live

  14. 2 domain8 yrs ago

    otx.alienvault.com/pulse/5ca740c67a9dbc78fe32f9b9 · accenture.com/t20190305T200954Z__w__/us-en/_acnmedia/… · us-cert.cisa.gov/ncas/alerts/aa21-200a · otx.alienvault.com/pulse/60f597533e911956a673717b · fireeye.com/blog/threat-research/2018/07/chinese-es…

    chemscalere.com
    scsnewstoday.com

  15. 1 domain8 yrs ago

    fireeye.com/blog/threat-research/2018/07/chinese-es…

    partyforumseasia.com

  16. 1 domain8 yrs ago

    us-cert.cisa.gov/ncas/alerts/aa21-200a · otx.alienvault.com/pulse/60f597533e911956a673717b · fireeye.com/blog/threat-research/2018/07/chinese-es…

    mlcdailynews.com

Further reading 26