Security Resilience

Threat actor · all actors

LeviathanG0065 state

🇨🇳 CN · MSS · Hainan Bureau

aka Leviathan, MUDCARP, Kryptonite Panda, Gadolinium, BRONZE MOHAWK, TEMP.Jumper, APT40, TEMP.Periscope, Gingham Typhoon, G0065, ATK29, TA423, Red Ladon, ITG09, ISLANDDREAMS, ISLAND CASTLE

Last updated: 2026-10-16

38attributed CVEs
73ATT&CK techniques
87.8IDF score (tooling uniqueness)
0exclusive CVEs
2012–2026years active

About this actor

[Leviathan](https://attack.mitre.org/groups/G0065) is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, [Leviathan](https://attack.mitre.org/groups/G0065) has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)(Citation: CISA Leviathan 2024)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0065

Microsoftweather-system names

Gingham Typhoon

CrowdStrikenation-animal names

Kryptonite Panda

Mandiant / genericAPT numbering

APT40

MandiantTEMP temporary cluster

TEMP.JumperTEMP.Periscope

Secureworkscolour-metal names

BRONZE MOHAWK

ProofpointTA threat-actor id

TA423

Unclassifiedno scheme matched

LeviathanMUDCARPGadoliniumATK29Red LadonITG09ISLANDDREAMSISLAND CASTLE

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 73 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

2012: 1 CVE published120122015: 1 CVE published120152017: 2 CVE published220172018: 2 CVE published220182019: 11 CVE published1120192020: 14 CVE published1420202021: 6 CVE published2021: 32 KEV added3820212022: 2 KEV added220222024: 1 KEV added120242026: 1 CVE published12026
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-11510 KEV10.010.01.00002019-05-08see CVE
CVE-2020-1350 KEV10.010.00.96722020-07-14see CVE
CVE-2021-44228 KEV10.010.01.00002021-12-10see CVE
CVE-2015-4852 KEV9.99.80.96882015-11-18see CVE
CVE-2018-4939 KEV9.99.80.97322018-05-19see CVE
CVE-2018-6789 KEV9.99.80.97482018-02-08see CVE
CVE-2019-0708 KEV9.99.81.00002019-05-16see CVE
CVE-2019-11580 KEV9.99.80.97502019-06-03see CVE
CVE-2019-16278 KEV9.99.80.99062019-10-14see CVE
CVE-2019-16920 KEV9.99.81.00002019-09-27see CVE
CVE-2019-18935 KEV9.99.80.99742019-12-11see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2019-3396 KEV9.99.80.99912019-03-25see CVE
CVE-2020-10189 KEV9.99.80.99942020-03-06see CVE
CVE-2020-15505 KEV9.99.80.99742020-07-07see CVE
CVE-2020-2555 KEV9.99.80.97122020-01-15see CVE
CVE-2020-5902 KEV9.99.81.00002020-07-01see CVE
CVE-2020-8515 KEV9.99.80.99992020-02-01see CVE
CVE-2021-26084 KEV9.99.81.00002021-08-30see CVE
CVE-2021-34473 KEV9.59.11.00002021-07-14see CVE
CVE-2012-0158 KEV9.28.80.99992012-04-10see CVE
CVE-2017-6327 KEV9.28.80.78182017-08-11see CVE
CVE-2020-0688 KEV9.28.80.99972020-02-11see CVE
CVE-2020-3118 KEV9.28.80.11812020-02-05see CVE
CVE-2020-1040 KEV9.09.00.07392020-07-14see CVE
CVE-2021-34523 KEV9.09.00.99992021-07-14see CVE
CVE-2020-0601 KEV8.78.10.97332020-01-14see CVE
CVE-2019-0803 KEV8.57.80.90362019-04-09see CVE
CVE-2019-1653 KEV8.57.50.99882019-01-24see CVE
CVE-2019-1652 KEV8.17.20.97472019-01-24see CVE
CVE-2020-8193 KEV7.86.50.97462020-07-10see CVE
CVE-2020-8195 KEV7.76.50.95852020-07-10see CVE
CVE-2021-31207 KEV7.76.60.99782021-05-11see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE
CVE-2020-8196 KEV7.54.30.70662020-07-10see CVE
CVE-2017-6328 6.98.80.02142017-08-11see CVE
CVE-2026-20929 6.27.50.02912026-01-13see CVE
CVE-2020-6789 5.87.80.00362021-03-25see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-441 / 7356%
CM-637 / 7351%
CM-232 / 7344%
SI-332 / 7344%
AC-328 / 7338%
AC-628 / 7338%
SC-728 / 7338%
AC-426 / 7336%
CA-726 / 7336%
CM-726 / 7336%
AC-223 / 7332%
SI-220 / 7327%
AC-518 / 7325%
CM-518 / 7325%
IA-218 / 7325%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category