Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT40 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT40

  • TEMP.Periscope
  • TEMP.Jumper
  • Leviathan
  • BRONZE MOHAWK
  • GADOLINIUM
  • KRYPTONITE PANDA
  • G0065
  • ATK29

state sponsor · ChinaMITRE G0065 ↗

APT40 — ATT&CK roseAP

attack rose · 50 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE2 new CVEs: CVE-2018-0802, CVE-2023-38831

Analyst brief

misp-galaxy + mitre-attack

Leviathan is an espionage actor targeting organizations and high-value targets in defense and government. Active since at least 2014, this actor has long-standing interest in maritime industries, naval defense contractors, and associated research institutions in the United States and Western Europe.

Observed targets (as stated by the sources)

11 countries · 2 sectors
United StatesHong KongCambodiaBelgiumGermanyPhilippinesMalaysiaNorwaySaudi ArabiaSwitzerlandUnited KingdomAssessed origin: China

assessed origin · Chinaobserved targets · 11

countries · 11

  • United States
  • Hong Kong
  • Cambodia
  • Belgium
  • Germany
  • Philippines
  • Malaysia
  • Norway
  • Saudi Arabia
  • Switzerland
  • United Kingdom

sectors · 2

  • Government
  • Private sector

also stated: The Philippines, Asia Pacific Economic Cooperation

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

50 techniques · 13 of 15 tactics

  1. Reconnaissance

    2 techniques

  2. Resource development

    8 techniques

  3. Initial access

    4 techniques

  4. Execution

    7 techniques

  5. Persistence

    4 techniques

  6. Privilege escalation

    1 technique

  7. Stealth

    9 techniques

  8. Defense impairment

    1 technique

  9. Credential access

    2 techniques

  10. Lateral movement

    3 techniques

  11. Collection

    3 techniques

  12. Command and control

    4 techniques

  13. Exfiltration

    2 techniques

select a technique

Arsenal

10 malware · 7 tools
Malware
Malware · 10ATT&CK
HOMEFRYS0232 ↗
DerusbiS0021 ↗
BLACKCOFFEES0069 ↗
gh0st RATS0032 ↗
MURKYTOPS0233 ↗
NanHaiShuS0228 ↗
OrzS0229 ↗
Cobalt StrikeS0154 ↗
China ChopperS0020 ↗
BADFLICKS0642 ↗
Tools
Tools · 7ATT&CK
Windows Credential EditorS0005 ↗
BITSAdminS0190 ↗
atS0110 ↗
EmpireS0363 ↗
NetS0039 ↗
PowerSploitS0194 ↗
TorS0183 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs APT40 is cited as exploiting

none on KEV
  1. CVE-2018-08022026-10-17
    1. “KRYPTONITE PANDA/APT40, a known contractor for MSS Hainan11 was found to have used high-value vulnerability CVE-2018-0802 as a 0day exploit”

      cited as exploiting · source: uscc.gov ↗ · 2026-10-17

    2. “the use by KRYPTONITE PANDA of a high-value vulnerability (CVE-2018-0802), discovered by Chinese firm Qihoo 360, a month before it was publicly revealed.”

      cited as exploiting · source: crowdstrike.com ↗ · 2026-10-17

  2. CVE-2023-388312026-10-17
    1. “In late August, ISLANDDREAMS (aka APT40) launched a phishing campaign targeting Papua New Guinea. The phishing emails included a Dropbox link to a ZIP archive containing the CVE-2023-38831 exploit, a password-protected decoy PDF, and an LNK file.”

      cited as exploiting · source: blog.google ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

41 sources
  1. 1.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spear…
  2. 2.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espiona…
  3. 3.cfr.org/interactive/cyber-operations/apt-40
  4. 4.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-n…
  5. 5.recordedfuture.com/chinese-threat-actor-tempperiscope
  6. 6.fireeye.com/blog/threat-research/2018/07/chinese-espionage-group-t…
  7. 7.attack.mitre.org/groups/G0065
  8. 8.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report
  9. 9.go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThrea…
  10. 10.intrusiontruth.wordpress.com/2020/01/09/what-is-the-hainan-xiandun-technology-devel…
  11. +31 more in the JSON record

Track APT40 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.