Leviathan Australian Intrusions

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Leviathan Australian Intrusions consisted of at least two long-term intrusions against victims in Australia by Leviathan, relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. Leviathan Australian Intrusions were focused on exfiltrating sensitive data including valid credentials for the victim organizations.(Citation: CISA Leviathan 2024)

This is a historical record and does not establish current campaign activity.

Threat actor

Leviathan

Attribution confidence

Not established

First documented activity

2022-04-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2022-04-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2022-09-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1021.002 · SMB/Windows Admin Shares

  Lateral Movement — Leviathan used remote shares to move laterally through victim networks during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1074.001 · Local Data Staging

  Collection — Leviathan stored captured credential material on local log files on victim systems during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1615 · Group Policy Discovery

  Discovery — Leviathan performed extensive Active Directory enumeration of victim environments during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1213.006 · Databases

  Collection — Leviathan gathered information from SQL servers and Building Management System (BMS) servers during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1552 · Unsecured Credentials

  Credential Access — Leviathan gathered credentials hardcoded in binaries located on victim devices during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1078.002 · Domain Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — Leviathan compromised domain credentials during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1686 · Disable or Modify System Firewall

  Defense Impairment — Leviathan modified system firewalls to add two open listening ports on 9998 and 9999 during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1552.001 · Credentials In Files

  Credential Access — Leviathan gathered credentials stored in files related to Building Management System (BMS) operations during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1082 · System Information Discovery

  Discovery — Leviathan performed host enumeration and data gathering operations on victim machines during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1018 · Remote System Discovery

  Discovery — Leviathan performed extensive remote host enumeration to build their own map of victim networks during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1190 · Exploit Public-Facing Application

  Initial Access — Leviathan exploited public-facing web applications and appliances for initial access during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1558.003 · Kerberoasting

  Credential Access — Leviathan used Kerberoasting techniques during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1041 · Exfiltration Over C2 Channel

  Exfiltration — Leviathan exfiltrated collected data over existing command and control channels during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1482 · Domain Trust Discovery

  Discovery — Leviathan performed Active Directory enumeration of victim environments during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1135 · Network Share Discovery

  Discovery — Leviathan scanned and enumerated remote network shares in victim environments during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1594 · Search Victim-Owned Websites

  Reconnaissance — Leviathan enumerated compromised web application resources to identify additional endpoints and resources linkd to the website for follow-on access during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1078 · Valid Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — Leviathan used captured, valid account information to log into victim web applications and appliances during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1056 · Input Capture

  Collection, Credential Access — Leviathan captured submitted multfactor authentication codes and other technical artifacts related to remote access sessions during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1505.003 · Web Shell

  Persistence — Leviathan relied extensively on web shell use following initial access for persistence and command execution purposes in victim environments during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1078.003 · Local Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — Leviathan used captured local account information, such as service accounts, for actions during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1068 · Exploitation for Privilege Escalation

  Privilege Escalation — Leviathan exploited software vulnerabilities in victim environments to escalate privileges during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1528 · Steal Application Access Token

  Credential Access — Leviathan abused access to compromised appliances to collect JSON Web Tokens (JWTs), used for creating virtual desktop sessions, during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1111 · Multi-Factor Authentication Interception

  Credential Access — Leviathan abused compromised appliance access to collect multifactor authentication token values during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1021.004 · SSH

  Lateral Movement — Leviathan used SSH brute force techniques to move laterally within victim environments during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

• T1212 · Exploitation for Credential Access

  Credential Access — Leviathan exploited vulnerable network appliances during Leviathan Australian Intrusions, leading to the collection and exfiltration of valid credentials.(Citation: CISA Leviathan 2024)

• T1588.006 · Vulnerabilities

  Resource Development — Leviathan weaponized publicly-known vulnerabilities for initial access and other purposes during Leviathan Australian Intrusions.(Citation: CISA Leviathan 2024)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0049

  Official MITRE ATT&CK campaign record C0049. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.