Leviathan

ACTIVE CAMPAIGN TRACKED ▲ High Threat China

Primary Aliases: APT40 Gingham Typhoon Kryptonite Panda BRONZE MOHAWK

Sponsor / State Affiliation People's Republic of China (Ministry of State Security)

Primary Motivation Geopolitical espionage, maritime strategic intelligence, and technology theft to support national security and regional dominance.

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

Indo-Pacific Maritime Espionage, Edge Device Exploitation Campaign

⚔️ Weaponized CVE Matrix (0)

No specific weaponized CVEs currently mapped in the public baseline.

🎯 Target Sectors & Focus

Maritime and Shipping Defense and Aerospace Government Agencies Telecommunications High-Tech and Semiconductor Manufacturing Supply Chain Vendors

🛡️ MITRE ATT&CK® Attack Lifecycle (8 TTPs)

📥 Download Navigator JSON

Initial Access 3

T1566 Spear-phishing with malicious attachments

T1566 Exploitation of edge-facing vulnerabilities (VPNs, Firewalls, Routers)

T1566 Supply chain compromise

Execution 1

T1059 Living-off-the-land (LotL) techniques

Persistence & Privilege Escalation 1

T1547 DLL Side-loading

Credential Access & Discovery 1

T1003 Credential harvesting via fake login portals

Command & Control 1

T1071 Custom malware deployment (e.g., various loaders and backdoors)

Operational Techniques 1

T1000 Use of Cobalt Strike for post-exploitation

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

No recent breaking campaign alerts recorded in the FlagThis threat database.

Copied to clipboard

LINK COPIED TO CLIPBOARD