Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: CISA Leviathan 2024)

ID: G0065

Associated Groups: BRONZE MOHAWK, Gadolinium, Kryptonite Panda, MUDCARP, APT40, TEMP.Periscope, Gingham Typhoon, TEMP.Jumper

Version: 4.1

Created: 18 Apr 2018

Last Modified: 03 Feb 2025

Name	Description
Associated Group Descriptions
BRONZE MOHAWK	(Citation: CISA AA21-200A APT40 July 2021)(Citation: SecureWorks BRONZE MOHAWK n.d.)
Gadolinium	(Citation: CISA AA21-200A APT40 July 2021)(Citation: MSTIC GADOLINIUM September 2020)
Kryptonite Panda	(Citation: CISA AA21-200A APT40 July 2021)(Citation: Crowdstrike KRYPTONITE PANDA August 2018)
MUDCARP	(Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)
APT40	FireEye reporting on TEMP.Periscope (which was combined into APT40) indicated TEMP.Periscope was reported upon as Leviathan.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: FireEye APT40 March 2019)
TEMP.Periscope	Leviathan was previously reported upon by FireEye as TEMP.Periscope and TEMP.Jumper.(Citation: CISA AA21-200A APT40 July 2021)(Citation: FireEye Periscope March 2018)(Citation: FireEye APT40 March 2019)
Gingham Typhoon	(Citation: Microsoft Threat Actor Naming July 2023)
TEMP.Jumper	Leviathan was previously reported upon by FireEye as TEMP.Periscope and TEMP.Jumper.(Citation: CISA AA21-200A APT40 July 2021)(Citation: FireEye APT40 March 2019)

Domain	ID		Name	Use
Techniques Used
Enterprise	T1583	.001	Acquire Infrastructure: Domains	Leviathan has established domains that impersonate legitimate entities to use for targeting efforts. (Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)
Enterprise	T1595	.002	Active Scanning: Vulnerability Scanning	Leviathan has conducted reconnaissance against target networks of interest looking for vulnerable, end-of-life, or no longer maintainted devices against which to rapidly deploy exploits.(Citation: CISA Leviathan 2024)
Enterprise	T1547	.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)
		.009	Boot or Logon Autostart Execution: Shortcut Modification	Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)
Enterprise	T1059	.001	Command and Scripting Interpreter: PowerShell	Leviathan has used PowerShell for execution.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)
		.003	Command and Scripting Interpreter: Windows Command Shell	Leviathan uses a backdoor known as BADFLICK that is is capable of generating a reverse shell, and has used multiple types of scripting for execution, including JavaScript and JavaScript Scriptlets in XML.(Citation: Proofpoint Leviathan Oct 2017).(Citation: FireEye Periscope March 2018)
		.005	Command and Scripting Interpreter: Visual Basic	Leviathan has used VBScript.(Citation: Proofpoint Leviathan Oct 2017)
Enterprise	T1586	.001	Compromise Accounts: Social Media Accounts	Leviathan has compromised social media accounts to conduct social engineering attacks.(Citation: CISA AA21-200A APT40 July 2021)
		.002	Compromise Accounts: Email Accounts	Leviathan has compromised email accounts to conduct social engineering attacks.(Citation: CISA AA21-200A APT40 July 2021)
Enterprise	T1584	.004	Compromise Infrastructure: Server	Leviathan has used compromised legitimate websites as command and control nodes for operations.(Citation: CISA Leviathan 2024)
		.008	Compromise Infrastructure: Network Devices	Leviathan has used compromised networking devices, such as small office/home office (SOHO) devices, as operational command and control infrastructure.(Citation: CISA Leviathan 2024)
Enterprise	T1074	.001	Data Staged: Local Data Staging	Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.(Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)
		.002	Data Staged: Remote Data Staging	Leviathan has staged data remotely prior to exfiltration.(Citation: CISA AA21-200A APT40 July 2021)
Enterprise	T1587	.004	Develop Capabilities: Exploits	Leviathan has rapidly transformed and adapted public exploit proof-of-concept code for new vulnerabilities and utilized them against target networks.(Citation: CISA Leviathan 2024)
Enterprise	T1585	.001	Establish Accounts: Social Media Accounts	Leviathan has created new social media accounts for targeting efforts.(Citation: CISA AA21-200A APT40 July 2021)
		.002	Establish Accounts: Email Accounts	Leviathan has created new email accounts for targeting efforts.(Citation: CISA AA21-200A APT40 July 2021)
Enterprise	T1546	.003	Event Triggered Execution: Windows Management Instrumentation Event Subscription	Leviathan has used WMI for persistence.(Citation: FireEye Periscope March 2018)
Enterprise	T1567	.002	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)
Enterprise	T1589	.001	Gather Victim Identity Information: Credentials	Leviathan has collected compromised credentials to use for targeting efforts.(Citation: CISA AA21-200A APT40 July 2021)
Enterprise	T1559	.002	Inter-Process Communication: Dynamic Data Exchange	Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents. (Citation: Accenture MUDCARP March 2019)
Enterprise	T1003	.001	OS Credential Dumping: LSASS Memory	Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.(Citation: FireEye APT40 March 2019)
Enterprise	T1027	.001	Obfuscated Files or Information: Binary Padding	Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.(Citation: Proofpoint Leviathan Oct 2017)
		.003	Obfuscated Files or Information: Steganography	Leviathan has used steganography to hide stolen data inside other files stored on Github.(Citation: CISA AA21-200A APT40 July 2021)
		.013	Obfuscated Files or Information: Encrypted/Encoded File	Leviathan has obfuscated code using base64.(Citation: Proofpoint Leviathan Oct 2017)
		.015	Obfuscated Files or Information: Compression	Leviathan has obfuscated code using gzip compression.(Citation: Proofpoint Leviathan Oct 2017)
Enterprise	T1566	.001	Phishing: Spearphishing Attachment	Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.(Citation: Proofpoint Leviathan Oct 2017)(Citation: CISA AA21-200A APT40 July 2021)
		.002	Phishing: Spearphishing Link	Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.(Citation: Proofpoint Leviathan Oct 2017)(Citation: CISA AA21-200A APT40 July 2021)
Enterprise	T1055	.001	Process Injection: Dynamic-link Library Injection	Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.(Citation: Accenture MUDCARP March 2019)
Enterprise	T1090	.003	Proxy: Multi-hop Proxy	Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.(Citation: CISA AA21-200A APT40 July 2021)
Enterprise	T1021	.001	Remote Services: Remote Desktop Protocol	Leviathan has targeted RDP credentials and used it to move through the victim environment.(Citation: FireEye APT40 March 2019)
		.004	Remote Services: SSH	Leviathan used ssh for internal reconnaissance.(Citation: FireEye APT40 March 2019)
Enterprise	T1505	.003	Server Software Component: Web Shell	Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.(Citation: FireEye APT40 March 2019)(Citation: CISA AA21-200A APT40 July 2021)(Citation: CISA Leviathan 2024)
Enterprise	T1553	.002	Subvert Trust Controls: Code Signing	Leviathan has used stolen code signing certificates to sign malware.(Citation: FireEye Periscope March 2018)(Citation: FireEye APT40 March 2019)
Enterprise	T1218	.010	System Binary Proxy Execution: Regsvr32	Leviathan has used regsvr32 for execution.(Citation: Proofpoint Leviathan Oct 2017)
Enterprise	T1204	.001	User Execution: Malicious Link	Leviathan has sent spearphishing email links attempting to get a user to click.(Citation: Proofpoint Leviathan Oct 2017)(Citation: CISA AA21-200A APT40 July 2021)
		.002	User Execution: Malicious File	Leviathan has sent spearphishing attachments attempting to get a user to click.(Citation: Proofpoint Leviathan Oct 2017)(Citation: CISA AA21-200A APT40 July 2021)
Enterprise	T1102	.003	Web Service: One-Way Communication	Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.(Citation: FireEye Periscope March 2018)

ID	Name	References	Techniques
Software
S0039	Net	(Citation: FireEye APT40 March 2019) (Citation: Microsoft Net Utility) (Citation: Savill 1999)	Domain Account, Local Account, Domain Groups, System Service Discovery, Network Share Discovery, Additional Local or Domain Groups, SMB/Windows Admin Shares, Local Account, Domain Account, System Network Connections Discovery, Local Groups, Network Share Connection Removal, Password Policy Discovery, Remote System Discovery, Service Execution, System Time Discovery
S0233	MURKYTOP	(Citation: CISA AA21-200A APT40 July 2021) (Citation: FireEye Periscope March 2018)	Permission Groups Discovery, Local Account, Network Share Discovery, System Information Discovery, Windows Command Shell, File Deletion, Remote System Discovery, Network Service Discovery, At
S0229	Orz	(Citation: AIRBREAK) (Citation: Accenture MUDCARP March 2019) (Citation: CISA AA21-200A APT40 July 2021) (Citation: FireEye Periscope March 2018) (Citation: Proofpoint Leviathan Oct 2017)	System Information Discovery, Modify Registry, System Network Configuration Discovery, Indicator Removal, File and Directory Discovery, Process Discovery, Process Hollowing, Obfuscated Files or Information, Regsvr32, Bidirectional Communication, Windows Command Shell, Software Discovery, Ingress Tool Transfer
S0110	at	(Citation: FireEye APT40 March 2019) (Citation: Linux at) (Citation: TechNet At)	At
S0194	PowerSploit	(Citation: CISA AA21-200A APT40 July 2021) (Citation: GitHub PowerSploit May 2012) (Citation: PowerShellMagazine PowerSploit July 2014) (Citation: PowerSploit Documentation)	Scheduled Task, Windows Management Instrumentation, Screen Capture, Keylogging, Path Interception by PATH Environment Variable, Audio Capture, Local Account, Windows Service, DLL, Credentials in Registry, Data from Local System, Reflective Code Loading, Security Support Provider, Path Interception by Search Order Hijacking, LSASS Memory, Domain Trust Discovery, Group Policy Preferences, Process Discovery, PowerShell, Registry Run Keys / Startup Folder, Indicator Removal from Tools, Path Interception by Unquoted Path, Query Registry, Path Interception, Windows Credential Manager, Command Obfuscation, Access Token Manipulation, Kerberoasting, Dynamic-link Library Injection
S0005	Windows Credential Editor	(Citation: Amplia WCE) (Citation: FireEye APT40 March 2019)	LSASS Memory
S0363	Empire	(Citation: CISA AA21-200A APT40 July 2021) (Citation: EmPyre) (Citation: GitHub ATTACK Empire) (Citation: Github PowerShell Empire) (Citation: NCSC Joint Report Public Tools) (Citation: PowerShell Empire)	Scheduled Task, Windows Management Instrumentation, Screen Capture, System Owner/User Discovery, Keylogging, Path Interception by PATH Environment Variable, Bypass User Account Control, Group Policy Discovery, Local Email Collection, Domain Account, Local Account, Windows Service, SSH, DLL, Automated Collection, Clipboard Data, Network Sniffing, Network Share Discovery, System Information Discovery, Native API, Process Injection, Timestomp, Shortcut Modification, Security Support Provider, Archive Collected Data, Credentials from Web Browsers, Path Interception by Search Order Hijacking, Group Policy Modification, Browser Information Discovery, Private Keys, Local Account, LLMNR/NBT-NS Poisoning and SMB Relay, LSASS Memory, Create Process with Token, Distributed Component Object Model, Video Capture, System Network Configuration Discovery, Accessibility Features, Command and Scripting Interpreter, Domain Account, Domain Trust Discovery, Golden Ticket, Automated Exfiltration, File and Directory Discovery, System Network Connections Discovery, Credentials In Files, Exfiltration to Code Repository, Process Discovery, Exfiltration Over C2 Channel, PowerShell, Exploitation of Remote Services, Registry Run Keys / Startup Folder, Exploitation for Privilege Escalation, SID-History Injection, Bidirectional Communication, Asymmetric Cryptography, Exfiltration to Cloud Storage, Path Interception by Unquoted Path, MSBuild, Security Software Discovery, Windows Command Shell, Silver Ticket, Command Obfuscation, Access Token Manipulation, Web Protocols, Network Service Discovery, Pass the Hash, Ingress Tool Transfer, Service Execution, Kerberoasting, Credential API Hooking, Commonly Used Port, Dylib Hijacking
S0642	BADFLICK	(Citation: Accenture MUDCARP March 2019) (Citation: FireEye Periscope March 2018)	Malicious File, Spearphishing Attachment, System Information Discovery, Data from Local System, Deobfuscate/Decode Files or Information, Archive via Library, Time Based Evasion, System Network Configuration Discovery, File and Directory Discovery, Ingress Tool Transfer
S0020	China Chopper	(Citation: Accenture MUDCARP March 2019) (Citation: CISA AA21-200A APT40 July 2021) (Citation: Dell TG-3390) (Citation: FireEye Periscope March 2018) (Citation: Lee 2013) (Citation: Rapid7 HAFNIUM Mar 2021)	Password Guessing, Data from Local System, Timestomp, Web Shell, File and Directory Discovery, Windows Command Shell, Software Packing, Web Protocols, Network Service Discovery, Ingress Tool Transfer
S0190	BITSAdmin	(Citation: FireEye Periscope March 2018) (Citation: Microsoft BITSAdmin)	Lateral Tool Transfer, BITS Jobs, Ingress Tool Transfer, Exfiltration Over Unencrypted Non-C2 Protocol
S0228	NanHaiShu	(Citation: CISA AA21-200A APT40 July 2021) (Citation: Proofpoint Leviathan Oct 2017) (Citation: fsecure NanHaiShu July 2016)	System Owner/User Discovery, Encrypted/Encoded File, JavaScript, DNS, System Information Discovery, System Network Configuration Discovery, Mshta, Registry Run Keys / Startup Folder, Disable or Modify Tools, File Deletion, Visual Basic, Ingress Tool Transfer
S0232	HOMEFRY	(Citation: FireEye Periscope March 2018)	OS Credential Dumping, Encrypted/Encoded File, Windows Command Shell
S0032	gh0st RAT	(Citation: Arbor Musical Chairs Feb 2018) (Citation: CISA AA21-200A APT40 July 2021) (Citation: FireEye Hacking Team) (Citation: Moudoor) (Citation: Mydoor) (Citation: Nccgroup Gh0st April 2018) (Citation: Novetta-Axiom)	Screen Capture, Rundll32, Standard Encoding, Keylogging, Shared Modules, Symmetric Cryptography, Windows Service, Fast Flux DNS, DLL, System Information Discovery, Native API, Deobfuscate/Decode Files or Information, Process Injection, Modify Registry, Clear Windows Event Logs, Command and Scripting Interpreter, Process Discovery, Registry Run Keys / Startup Folder, Encrypted Channel, Non-Application Layer Protocol, Query Registry, File Deletion, Ingress Tool Transfer, Service Execution
S0021	Derusbi	(Citation: CISA AA21-200A APT40 July 2021) (Citation: Fidelis Turbo) (Citation: FireEye Periscope March 2018) (Citation: Novetta-Axiom) (Citation: PHOTO) (Citation: ThreatConnect Anthem)	Screen Capture, System Owner/User Discovery, Keylogging, Audio Capture, Symmetric Cryptography, System Information Discovery, Timestomp, Video Capture, File and Directory Discovery, Process Discovery, Unix Shell, Non-Standard Port, Regsvr32, Non-Application Layer Protocol, Query Registry, File Deletion, Fallback Channels, Dynamic-link Library Injection, Custom Command and Control Protocol, Commonly Used Port
S0154	Cobalt Strike	(Citation: CISA AA21-200A APT40 July 2021) (Citation: FireEye Periscope March 2018) (Citation: Proofpoint Leviathan Oct 2017) (Citation: cobaltstrike manual)	Windows Management Instrumentation, Screen Capture, Rundll32, Standard Encoding, Keylogging, JavaScript, Bypass User Account Control, Sudo and Sudo Caching, Security Account Manager, DNS, Domain Account, Symmetric Cryptography, Windows Service, Domain Groups, SSH, System Service Discovery, Code Signing, Network Share Discovery, Application Layer Protocol, Native API, Data from Local System, Deobfuscate/Decode Files or Information, Process Injection, Timestomp, Reflective Code Loading, Scheduled Transfer, SMB/Windows Admin Shares, Protocol Tunneling, Browser Session Hijacking, Modify Registry, Windows Remote Management, LSASS Memory, Distributed Component Object Model, System Network Configuration Discovery, Office Template Macros, File and Directory Discovery, System Network Connections Discovery, Token Impersonation/Theft, Make and Impersonate Token, Process Discovery, Parent PID Spoofing, PowerShell, Multiband Communication, File Transfer Protocols, Local Groups, Disable or Modify Tools, Indicator Removal from Tools, Process Hollowing, Exploitation for Privilege Escalation, Obfuscated Files or Information, Exploitation for Client Execution, Asymmetric Cryptography, Non-Application Layer Protocol, Protocol or Service Impersonation, Query Registry, Data Transfer Size Limits, Domain Accounts, BITS Jobs, Domain Fronting, Python, Windows Command Shell, Web Protocols, Visual Basic, Remote System Discovery, Network Service Discovery, Software Discovery, Pass the Hash, Ingress Tool Transfer, Remote Desktop Protocol, Service Execution, Dynamic-link Library Injection, Internal Proxy, Custom Command and Control Protocol, Commonly Used Port, Local Accounts, Process Argument Spoofing
S0154	Cobalt Strike	(Citation: FireEye Periscope March 2018) (Citation: Proofpoint Leviathan Oct 2017) (Citation: cobaltstrike manual)	Windows Management Instrumentation, Screen Capture, Rundll32, Standard Encoding, Keylogging, JavaScript, Bypass User Account Control, Sudo and Sudo Caching, Security Account Manager, DNS, Domain Account, Symmetric Cryptography, Windows Service, Domain Groups, SSH, System Service Discovery, Code Signing, Network Share Discovery, Application Layer Protocol, Native API, Data from Local System, Deobfuscate/Decode Files or Information, Process Injection, Timestomp, Reflective Code Loading, Scheduled Transfer, SMB/Windows Admin Shares, Protocol Tunneling, Browser Session Hijacking, Modify Registry, Windows Remote Management, LSASS Memory, Distributed Component Object Model, System Network Configuration Discovery, Office Template Macros, File and Directory Discovery, System Network Connections Discovery, Token Impersonation/Theft, Make and Impersonate Token, Process Discovery, Parent PID Spoofing, PowerShell, Multiband Communication, File Transfer Protocols, Local Groups, Disable or Modify Tools, Indicator Removal from Tools, Process Hollowing, Exploitation for Privilege Escalation, Obfuscated Files or Information, Exploitation for Client Execution, Asymmetric Cryptography, Non-Application Layer Protocol, Protocol or Service Impersonation, Query Registry, Data Transfer Size Limits, Domain Accounts, BITS Jobs, Domain Fronting, Python, Windows Command Shell, Web Protocols, Visual Basic, Remote System Discovery, Network Service Discovery, Software Discovery, Pass the Hash, Ingress Tool Transfer, Remote Desktop Protocol, Service Execution, Dynamic-link Library Injection, Internal Proxy, Custom Command and Control Protocol, Commonly Used Port, Local Accounts, Process Argument Spoofing
S0069	BLACKCOFFEE	(Citation: FireEye APT17) (Citation: FireEye Periscope March 2018)	File and Directory Discovery, Multi-Stage Channels, Process Discovery, Bidirectional Communication, Windows Command Shell, File Deletion, Dead Drop Resolver
S0183	Tor	(Citation: CISA AA21-200A APT40 July 2021) (Citation: Dingledine Tor The Second-Generation Onion Router)	Multi-hop Proxy, Asymmetric Cryptography

References

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Leviathan

Associated Group Descriptions

Techniques Used

Software

References