NanHaiShu — Malware Profile

NanHaiShu is a remote access tool and JScript backdoor used by Leviathan. NanHaiShu has been used to target government and private-sector organizations that have relations to the South China Sea dispute.

MITRE ATT&CK techniques (12)

• T1016 System Network Configuration Discovery
• T1027.013 Encrypted/Encoded File
• T1033 System Owner/User Discovery
• T1059.005 Visual Basic
• T1059.007 JavaScript
• T1070.004 File Deletion
• T1071.004 DNS
• T1082 System Information Discovery
• T1105 Ingress Tool Transfer
• T1218.005 Mshta
• T1547.001 Registry Run Keys / Startup Folder
• T1685 Disable or Modify Tools

IntelFusions coverage

• Leviathan: Chinese Espionage Actor Targets Maritime, Naval Defense, and Military Research with Orz, NanHaiShu, and Cobalt Strike 2026-02-16

Attributed threat actors

• APT40

Read the full analysis on IntelFusions