Leviathan
Leviathan is a cyber espionage group that has been active since at least 2013. The group generally targets defense and government organizations, but has also targeted a range of industries including engineering firms, shipping and transportation, manufacturing, defense, government offices, and research universities in the United States, Western Europe, and along the South China Sea. [1] [2]
Associated Group Descriptions
Name | Description |
---|---|
TEMP.Jumper | Leviathan was previously reported upon by FireEye as TEMP.Periscope and TEMP.Jumper.[3] |
APT40 | The group identified by Proofpoint as Leviathan appears to significantly overlap with FireEye's reporting on APT40. Additionally, FireEye reporting on TEMP.Periscope (which was combined into APT40) indicated TEMP.Periscope was reported upon as Leviathan.[2][3][1] |
TEMP.Periscope | Leviathan was previously reported upon by FireEye as TEMP.Periscope and TEMP.Jumper.[2][3] |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1197 | BITS Jobs |
Leviathan has used BITSAdmin to download additional tools.[2] |
|
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.[1][2] |
.009 | Boot or Logon Autostart Execution: Shortcut Modification |
Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.[1][2] |
||
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
Leviathan uses a backdoor known as BADFLICK that is is capable of generating a reverse shell, and has used multiple types of scripting for execution, including JavaScript and JavaScript Scriptlets in XML.[1].[2] |
.005 | Command and Scripting Interpreter: Visual Basic | |||
.001 | Command and Scripting Interpreter: PowerShell | |||
Enterprise | T1074 | .001 | Data Staged: Local Data Staging |
Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.[2] |
Enterprise | T1140 | Deobfuscate/Decode Files or Information |
Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.[1] |
|
Enterprise | T1546 | .003 | Event Triggered Execution: Windows Management Instrumentation Event Subscription | |
Enterprise | T1567 | .002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage |
Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.[1][2] |
Enterprise | T1203 | Exploitation for Client Execution |
Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.[1][2] |
|
Enterprise | T1105 | Ingress Tool Transfer |
Leviathan has downloaded additional scripts and files from adversary-controlled servers.[1][2] |
|
Enterprise | T1027 | Obfuscated Files or Information |
Leviathan has obfuscated code using base64 and gzip compression.[1] |
|
.001 | Binary Padding |
Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.[1] |
||
Enterprise | T1003 | OS Credential Dumping |
Leviathan has used publicly available tools to dump password hashes, including HOMEFRY. [3] |
|
.001 | LSASS Memory |
Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE. [3] |
||
Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.[1] |
.002 | Phishing: Spearphishing Link |
Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.[1] |
||
Enterprise | T1021 | .004 | Remote Services: SSH | |
.001 | Remote Services: Remote Desktop Protocol |
Leviathan has targeted RDP credentials and used it to move through the victim environment.[3] |
||
Enterprise | T1505 | .003 | Server Software Component: Web Shell |
Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems. [3] |
Enterprise | T1218 | .010 | Signed Binary Proxy Execution: Regsvr32 | |
Enterprise | T1553 | .002 | Subvert Trust Controls: Code Signing |
Leviathan has used stolen code signing certificates to sign malware.[2][3] |
Enterprise | T1204 | .002 | User Execution: Malicious File |
Leviathan has sent spearphishing attachments attempting to get a user to click.[1] |
.001 | User Execution: Malicious Link |
Leviathan has sent spearphishing email links attempting to get a user to click.[1] |
||
Enterprise | T1078 | Valid Accounts |
Leviathan has used valid, compromised email accounts for defense evasion, including to send malicious emails to other victim organizations.[1] |
|
Enterprise | T1102 | .003 | Web Service: One-Way Communication |
Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.[2] |
Enterprise | T1047 | Windows Management Instrumentation |