CNChinaconfidence: 50G0065
APT40APT40
Also known as: TEMP.Periscope · TEMP.Jumper · Leviathan · BRONZE MOHAWK · GADOLINIUM · KRYPTONITE PANDA · G0065 · ATK29 · TA423 · Red Ladon · ITG09 · MUDCARP · ISLANDDREAMS · Gingham Typhoon · APT40
Origin
CN
Known aliases
15
Target sectors
2
Attribution
State-sponsored
Profile
Leviathan is an espionage actor targeting organizations and high-value targets in defense and government. Active since at least 2014, this actor has long-standing interest in maritime industries, naval defense contractors, and associated research institutions in the United States and Western Europe.
Aliases· 15
TEMP.PeriscopeTEMP.JumperLeviathanBRONZE MOHAWKGADOLINIUMKRYPTONITE PANDAATK29TA423Red LadonITG09MUDCARPISLANDDREAMSGingham TyphoonAPT40
Target sectors· 2
GovernmentPrivate sector
Known victims· 13
- United States
- Hong Kong
- The Philippines
- Asia Pacific Economic Cooperation
- Cambodia
- Belgium
- Germany
- Philippines
- Malaysia
- Norway
- Saudi Arabia
- Switzerland
MITRE ATT&CK Group crosswalk
References
- https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets
- https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html
- https://www.cfr.org/interactive/cyber-operations/apt-40
- https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html
- https://www.recordedfuture.com/chinese-threat-actor-tempperiscope/
- https://www.fireeye.com/blog/threat-research/2018/07/chinese-espionage-group-targets-cambodia-ahead-of-elections.html
- https://attack.mitre.org/groups/G0065/
- https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.