APT40 — APT Profile
Leviathan is an espionage actor targeting organizations and high-value targets in defense and government. Active since at least 2014, this actor has long-standing interest in maritime industries, naval defense contractors, and associated research institutions in the United States and Western Europe.Also tracked as
Leviathan, MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper, TEMP.Periscope, Gingham Typhoon, Hazel Typhoon, GADOLINIUM, G0065, ATK29, TA423, Red Ladon, ITG09, ISLANDDREAMS, ISLAND CASTLE
IntelFusions coverage (2)
- FBI and CISA Expose APT40: China's MSS-Linked Hainan Hackers Indicted for Global Espionage Campaign 2026-02-16 · Nation-State
- Leviathan: Chinese Espionage Actor Targets Maritime, Naval Defense, and Military Research with Orz, NanHaiShu, and Cobalt Strike 2026-02-16 · Nation-State
Tools & malware
- js.airbreak Backdoor
- js.cactustorch Loader
- js.nanhaishu Backdoor
- js.scanbox Reconnaissance Framework
- win.badflick Backdoor
- win.blackcoffee Backdoor
- win.chinachopper Web Shell
- win.cobalt_strike Adversary Simulation
- win.dadjoke Backdoor
- win.dadstache Backdoor
- win.derusbi Backdoor
- win.ghost_rat Remote Access Trojan
- win.grillmark Backdoor
- win.homefry Backdoor
- win.lazycat Backdoor
- win.lunchmoney Backdoor
- win.murkytop Backdoor
- win.plugx Backdoor
- win.sedll Backdoor
- win.zxshell Remote Access Trojan
Vendor research
- APT40: Examining a China-Nexus Espionage Actor Plan, F., et al
- Threat Profile - BRONZE MOHAWK SecureWorks
- Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries FireEye
- Microsoft Security - Detecting Empires in the Cloud Ben Koehl, Joe Hannon
- People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action CISA et al
- (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department CISA
- How Microsoft names threat actors Microsoft
- APT40: Examining a China-Nexus Espionage Actor Plan, F., et al
- Threat Profile - BRONZE MOHAWK SecureWorks
- Mudcarp's Focus on Submarine Technologies Accenture iDefense Unit
- Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries FireEye
- Two Birds, One Stone Panda Adam Kozy
- Leviathan: Espionage actor spearphishes maritime and defense targets Axel F, Pierre T
Countries linked to this actor
- Australia targets
- Canada targets
- Saudi Arabia targets
- Malaysia targets
- China origin
- Indonesia targets
- South Africa targets
- Papua New Guinea targets