Leviathan Australian IntrusionsC0049 state

About this actor

[Leviathan Australian Intrusions](https://attack.mitre.org/campaigns/C0049) consisted of at least two long-term intrusions against victims in Australia by [Leviathan](https://attack.mitre.org/groups/G0065), relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. [Leviathan Australian Intrusions](https://attack.mitre.org/campaigns/C0049) were focused on exfiltrating sensitive data including valid credentials for the victim organizations.(Citation: CISA Leviathan 2024)

Source: MITRE ATT&CK

Activity timeline

No activity events recorded.

Profile

Mitigating controls (NIST 800-53)

Co-occurring actors

None.

Similar actors