Proofpoint researchers published tracking data on Proofpoint for Leviathan — a Chinese espionage actor active since at least 2014 with sustained focus on maritime industries, naval defense contractors, shipbuilding research, and military-affiliated universities in the United States and Western Europe. The group combines custom JavaScript backdoors (Orz and NanHaiShu), Cobalt Strike, and the SeDll/MockDll loader chain with rapid exploitation of freshly disclosed vulnerabilities, lookalike domain infrastructure, and lateral movement through compromised victim email accounts and servers.
Targeting Profile: Naval Defense and South China Sea Interests
Leviathan's targeting consistently centers on maritime and naval themes across all observed campaign periods. US shipbuilding companies, Navy-related universities and research centers, Western European defense contractors, and South China Sea stakeholders — including the Philippines Department of Justice, APEC organizers, and international maritime law firms — have all been targeted. The actor also uses access gained at one compromised organization to conduct secondary attacks, forwarding malicious attachments from stolen email accounts within the same industry, and compromising victim web servers for C2 hosting.
Rapid Vulnerability Exploitation and Multi-Vector Delivery
Leviathan demonstrates a consistent pattern of exploiting vulnerabilities within days of public disclosure. In September 2017, spearphishing emails using "Apply for internship position" subject lines and CVs or torpedo recovery experiment lures exploited CVE-2017-8759 just five days after its documentation. August 2017 campaigns against defense contractors exploited CVE-2017-0199 via malicious URLs linking to documents impersonating a major shipbuilder's brand. Earlier campaigns (2014–2015) used macro-laden Excel and Word documents targeting Navy-affiliated universities and South China Sea political entities. The group also deployed malicious Microsoft Publisher files requiring multiple user interactions — embedding PowerShell execution triggered by mouse movement and an "Enable" dialog — reflecting willingness to use lower-sophistication social engineering alongside zero-day exploitation.
Installation Chain: CVE-2017-8759 to Cobalt Strike
The September 2017 resume.rtf chain illustrates the group's layered installer approach: the RTF exploits CVE-2017-8759 to retrieve a SOAP WSDL definition via anonymous FTP, which downloads a VBScript disguised as favicon.ico that drops two JavaScript files. The smaller JavaScript deobfuscates link.js into %TMP% and creates a "Java(TM) Platform SE Auto Updater.lnk" startup shortcut for persistence. The larger JavaScript downloads and executes a Cobalt Strike payload via a base64/Gzip-obfuscated PowerShell downloader. The Publisher file chain follows a similar structure — 0.js creates an "office365.lnk" startup shortcut using the Squiblydoo (regsvr32) technique, then downloads SeDll (SEDll_Win32.dll) and payload files, with SeDll decrypting and executing the final Orz JavaScript backdoor.
Custom Backdoors: Orz and NanHaiShu
Orz, named for a variable in the code (renamed "core" in later versions), is the group's primary JavaScript backdoor observed from 2014 through 2017. It supports information gathering (IE version, OS version, architecture), registry modification to reduce malware visibility, file upload/download, command execution via cscript/shell/JavaScript, DLL execution via embedded MockDll, process enumeration and termination, drive enumeration, and HTTP GET/POST to C2. Its configuration section includes a jmpUrlList for initial C2 servers that resolve a secondary encoded C2 via regex, with attacker-controlled servers, compromised victim servers, and Technet/Pastebin pages all observed as initial C2 channels.
NanHaiShu is an earlier JavaScript backdoor (some variants wrapped in HTA) with basic capabilities: system information gathering, URL downloading, JavaScript execution, and IE security setting modification (SafeIE) to suppress malware activity warnings. Both backdoors are continuously refined across campaigns while maintaining their core architecture.