Quick links
Press Enter to search, Esc to close
Threat group profile
APT40 (tracked by MITRE as Leviathan) is attributed by the US and UK governments (2021) and by agencies in eight countries (2024) to China's Ministry of State Security.
In short
APT40 (tracked by MITRE as Leviathan) is attributed by the US and UK governments (2021) and by agencies in eight countries (2024) to China's Ministry of State Security. The US charged four people in 2021, three of them named as officers of its Hainan State Security Department.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| APT40 | MITRE ATT&CK Associated Groups; CISA and FBI advisory AA21-200A; 2021 US indictment; UK government statement of 19 July 2021; 2024 joint advisory[1, 11, 12, 14, 15] |
| Leviathan | MITRE ATT&CK group name; AA21-200A; 2021 US indictment; UK government table; 2024 joint advisory[1, 11, 12, 14, 15] |
| MUDCARP | MITRE ATT&CK Associated Groups; AA21-200A; 2021 US indictment[1, 11, 12] |
| Kryptonite Panda | MITRE ATT&CK Associated Groups; AA21-200A; 2021 US indictment; 2024 joint advisory[1, 11, 12, 15] |
| Gadolinium | MITRE ATT&CK Associated Groups; AA21-200A; 2021 US indictment[1, 11, 12] |
| BRONZE MOHAWK | MITRE ATT&CK Associated Groups; AA21-200A; 2021 US indictment; 2024 joint advisory (as Bronze Mohawk)[1, 11, 12, 15] |
| TEMP.Jumper | MITRE ATT&CK Associated Groups; AA21-200A; 2021 US indictment; UK government table[1, 11, 12, 14] |
| TEMP.Periscope | MITRE ATT&CK Associated Groups; AA21-200A; 2021 US indictment; UK government table[1, 11, 12, 14] |
| Gingham Typhoon | MITRE ATT&CK Associated Groups; 2024 joint advisory (as GINGHAM TYPHOON)[1, 15] |
| Periscope | AA21-200A and the 2021 US indictment list it as a label; it is not on the MITRE Associated Groups list[11, 12] |
| FEVERDREAM | AA21-200A and the 2021 US indictment list it as a label; it is not on the MITRE Associated Groups list[11, 12] |
| GreenCrash | AA21-200A and the 2021 US indictment list it as a label; the indictment also uses it as another name for the BADFLICK malware[11, 12] |
| Hellsing | AA21-200A and the 2021 US indictment list it as a label; it is not on the MITRE Associated Groups list[11, 12] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK page created 18 April 2018, version 4.1 modified 31 July 2026
Describes Leviathan as a Chinese state-sponsored cyber espionage group that has been attributed to the MSS Hainan State Security Department and an affiliated front company. Lists it as active since at least 2009.[1]
US District Court, Southern District of California (grand jury) filed 28 May 2021
Indictment charges three HSSD officers and a hacker with conspiracy to damage protected computers and conspiracy to commit economic espionage. It alleges the HSSD created Hainan Xiandun in 2011 as a front company and that the conspiracy ran from no later than July 2009 to September 2018.[12]
US Department of Justice 19 July 2021
Unsealed the indictment against four people described by CISA and the FBI as APT40 cyber actors, working through the front company Hainan Xiandun.[11]
CISA and FBI 19 July 2021 (page last revised 20 July 2021)
Joint advisory on a Chinese group known in open-source reporting as APT40. It says the group is located in Haikou, Hainan Province, and has been active since at least 2009.[11]
UK Foreign, Commonwealth & Development Office and NCSC 19 July 2021
Attributed the Chinese Ministry of State Security as being behind activity known as APT40 and APT31.[13, 14]
UK National Cyber Security Centre 19 July 2021
Judged it highly likely that APT40 is linked to the Ministry of State Security and highly likely sponsored by the MSS Hainan State Security Department.[14]
Ministry of Foreign Affairs of Latvia 19 July 2021
Stated that the EU and its Member States have been targeted by hacker groups APT40 and APT31, which are involved in intellectual property theft and espionage.[17]
Authors of the 2024 joint advisory (agencies of Australia, Canada, Germany, Japan, New Zealand, South Korea, the UK and the US) 8 July 2024
Assessed that the group conducts malicious cyber operations for the Ministry of State Security, with activity and techniques that overlap with groups tracked as APT40. Said it was previously reported as based in Haikou and tasked by the HSSD.[15, 16]
Sources differ in wording and in the dates they give. MITRE says Leviathan "has been attributed to" the MSS Hainan State Security Department and a front company. The UK NCSC (19 July 2021) used "highly likely" for both the MSS link and HSSD sponsorship. The 2024 joint advisory says the activity "overlap[s]" with groups tracked as APT40 and repeats the Haikou and HSSD point as "previously reported". On dates, MITRE and the 2021 CISA and FBI advisory say active since at least 2009; the US indictment alleges a conspiracy from no later than July 2009 to September 2018 and Hainan Xiandun hacking from 2011 to at least 2018. The label lists also differ: MITRE lists nine names, while AA21-200A and the indictment list thirteen.
Each entry is attributed to the group by the sources cited.
The indictment alleges the HSSD established a front company called Hainan Kehua to recruit hackers and linguists.[12]
The indictment alleges the HSSD created Hainan Xiandun, a front company.[12]
The indictment alleges Hainan Xiandun employed hackers who stole data from companies and universities, including in virus and maritime research.[12]
MITRE says the Orz backdoor was observed in 2014 and in August 2017.[9]
MITRE says spearphishing campaigns with the BADFLICK backdoor, first reported in 2018, targeted US engineering and maritime industries.[3]
The UK table lists targeting of multiple Cambodian electoral entities in the run up to the 2018 election.[14]
The indictment's conspiracy period runs up to and including September 2018.[12]
A grand jury in the Southern District of California indicts Ding Xiaoyang, Cheng Qingmin, Zhu Yunmin and Wu Shurong.[12]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 28 May 2021 | US District Court, Southern District of California (grand jury) | Indictment filedDing Xiaoyang, Cheng Qingmin, Zhu Yunmin and Wu Shurong charged; the heading lists conspiracy to damage protected computers and conspiracy to commit economic espionage.[12] |
| 19 July 2021 | US Department of Justice | Indictment unsealedDescribed by CISA and the FBI as an indictment against four APT40 cyber actors working through Hainan Xiandun.[11] |
| 19 July 2021 | CISA and FBI | Joint cybersecurity advisory AA21-200AGives the group's tactics, techniques and indicators of compromise, with mitigations.[11] |
| 19 July 2021 | UK Foreign, Commonwealth & Development Office and NCSC | Public attributionAttributed the Chinese Ministry of State Security as being behind activity known as APT40 and APT31.[13, 14] |
| 19 July 2021 | Ministry of Foreign Affairs of Latvia | National statementSaid the EU and its Member States have been targeted by hacker groups APT40 and APT31.[17] |
| 8 July 2024 | Agencies of Australia, Canada, Germany, Japan, New Zealand, South Korea, the UK and the US | Joint advisory AA24-190AAssesses the group works for the Ministry of State Security and describes two Australian case studies with mitigations.[15, 16] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Acquire Infrastructure: Domains T1583.001
Sets up domains that impersonate legitimate entities. The indictment calls them doppelganger domains.[1, 11, 12]
Compromise Infrastructure: Network Devices T1584.008
Uses compromised small office and home office devices as command and control infrastructure.[1, 15]
Exploit Public-Facing Application T1190
The 2024 advisory says it prefers exploiting public-facing systems over phishing and adapts public exploit code within hours or days.[1, 15]
Phishing: Spearphishing Attachment T1566.001
Sends emails with malicious attachments such as .rtf, .doc and .xls files.[1, 11, 12]
Phishing: Spearphishing Link T1566.002
Sends emails with links, often using a lookalike domain and stolen branding.[1, 11]
External Remote Services T1133
Valid Accounts T1078
Obtains valid accounts. The 2024 advisory says it puts a high priority on obtaining valid credentials.[1, 15]
Steal or Forge Kerberos Tickets: Kerberoasting T1558.003
Used Kerberoasting to obtain network credentials in the Australian intrusions.[1, 15]
Multi-Factor Authentication Interception T1111
Collected multi-factor authentication token values from a compromised appliance in the Australian intrusions.[1, 15]
China Chopper Web shell
MITRE says it gives access back into a network without needing a callback to a remote server. AA21-200A lists it among the group's tools.[4, 11]
Derusbi Malware
MITRE says multiple Chinese groups use it. The indictment names it (as PHOTO) among the malware the conspirators used.[5, 11, 12]
BADFLICK Backdoor
MITRE says it was used in spearphishing campaigns first reported in 2018. The indictment also gives it the name GreenCrash.[3, 12]
MURKYTOP Reconnaissance tool
MITRE describes it as a reconnaissance tool used by Leviathan. The indictment also lists it as mt.exe.[6, 12]
HOMEFRY Password dumper
MITRE describes a 64-bit Windows password dumper and cracker used with other Leviathan backdoors.[7]
NanHaiShu Remote access tool and backdoor
MITRE says it was used against organizations linked to the South China Sea dispute.[8, 11]
Orz JavaScript backdoor
gh0st RAT Remote access tool
MITRE says its source code is public and that multiple groups use it. AA21-200A lists Gh0stRAT among the group's tools.[10, 11]
Secure Socket Funnelling Open-source tunnelling tool
The 2024 advisory says it was used in one Australian case to connect out to the group's infrastructure.[15]
Also linked in our threat library:
See which web applications, VPN and remote access gateways and old devices your organization exposes to the internet, the places advisories say this group looks first.
Follow government and MITRE reporting on this group and compare its listed techniques with your own detection and controls.
Find lookalike domains that copy your brand, a method the indictment and MITRE describe for this group.
Watch for leaked or sold company credentials, since MITRE and the 2024 advisory describe valid accounts as a main way in.
APT40 is a label used by CISA, the FBI and the UK government. MITRE tracks the same activity as Leviathan (G0065). It is attributed to China's Ministry of State Security by the UK and US (2021) and by the authors of the 2024 joint advisory.
A grand jury indicted four people, filed on 28 May 2021 and unsealed on 19 July 2021. Three are named as officers of the MSS Hainan State Security Department and one as a hacker at the front company Hainan Xiandun. These are charges. The sources opened for this page do not report a court outcome.
The 2024 joint advisory says the group appears to prefer exploiting public-facing systems over phishing and puts a high priority on valid credentials. MITRE and the 2021 advisory also list spearphishing, VPN access and watering holes.
MITRE lists academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime and transportation, in the US, Canada, Australia, Europe, the Middle East and Southeast Asia. The 2024 advisory says Australian networks have been targeted repeatedly.
The most recent government source opened is the July 2024 joint advisory, with case studies from 2022. No source opened for this page dates activity in the last two years, so Brandefense lists the status as dormant.
Patch internet-facing systems quickly, turn on multi-factor authentication for remote access, and check web servers for web shells.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.