{
  "id": "leviathan",
  "name": "Leviathan",
  "aliases": [
    "MUDCARP",
    "Kryptonite Panda",
    "Gadolinium",
    "BRONZE MOHAWK",
    "TEMP.Jumper",
    "APT40",
    "TEMP.Periscope",
    "Gingham Typhoon"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "State-sponsored cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.",
  "specs": [
    {
      "k": "sponsor",
      "v": "China's MSS Hainan State Security Department and front company",
      "src": [
        "mitre-g0065"
      ],
      "conf": "high"
    },
    {
      "k": "active_since",
      "v": 2009,
      "src": [
        "mitre-g0065"
      ],
      "conf": "medium",
      "note": "At least 2009"
    },
    {
      "k": "attack_id",
      "v": "G0065",
      "src": [
        "mitre-g0065"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.",
      "src": [
        "mitre-g0065"
      ],
      "conf": "medium"
    },
    {
      "k": "campaigns",
      "v": "Leviathan Australian Intrusions (C0049, 2022–2022)",
      "src": [
        "mitre-g0065"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 50,
      "src": [
        "mitre-g0065"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "at, BADFLICK, BITSAdmin, BLACKCOFFEE, China Chopper, Cobalt Strike, Derusbi, Empire, gh0st RAT, HOMEFRY, MURKYTOP, NanHaiShu, Net, Orz, PowerSploit, Tor, Windows Credential Editor",
      "src": [
        "mitre-g0065"
      ],
      "conf": "high",
      "note": "17 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company. Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0065)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/leviathan.html",
  "sources": {
    "mitre-g0065": {
      "title": "Leviathan, Group G0065",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0065/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}