ChinaAttributedMSS Hainan State Security DeptEspionageActive 2009 – 2024Leviathan
Also known asAPT40 · BRONZE MOHAWK · TEMP.Periscope · GADOLINIUM · Temp.Jumper · MUDCARP · TA423 · Red Ladon · KRYPTONITE PANDA · ATK29 · ITG09 · ISLANDDREAMS · Gingham Typhoon · Jumper Taurus
Summary
MSS Hainan APT focused on maritime, defense, and naval research intel. Rapid CVE exploitation. Four officers indicted July 2021. 2024 Five Eyes advisory: active exploitation of end-of-life SOHO devices.
Attribution
AttributedGovernment attribution: MSS Hainan State Security Dept
Named by a government: indictment, sanctions designation, joint advisory or official statement.
Sources
- ASD ACSC and partner agencies (APT40 advisory) (Government, 2024-07-09)
Operates for the MSS; tasking from its Hainan State Security Department - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Attributed to the MSS Hainan State Security Department and a front company
Campaigns 1
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Australian government & private-sector network intrusions (ASD-led joint advisory) | 2022-04 – ongoing | Australia, Asia-Pacific region | Government, Private sector | ASD's ACSC + 8 partner agencies, APT40 Advisory (2024-07-08; IC3 copy) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 11
| Resource Development3 | T1584.008Network DevicesT1587.004ExploitsT1584.004Server |
|---|---|
| Initial Access3 | T1190Exploit Public-Facing ApplicationT1566.001Spearphishing AttachmentT1199Trusted Relationship |
| Persistence1 | T1078Valid Accounts |
| Stealth2 | T1055Process InjectionT1027.015Compression |
| Credential Access2 | T1003OS Credential DumpingT1556.005Reversible Encryption |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| AIRBREAK | JavaScript Backdoor | Windows |
| BADFLICK | RAT | Windows |
| ScanBox | Browser Recon Framework | JavaScript |
| China Chopper | Web Shell | Web Servers |
Exploited vulnerabilities 6
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-44228 | 10 | Apache Log4Shell (KEV 2021-12-10) |
| CVE-2021-26084 | 9.8 | Atlassian Confluence (KEV 2021-11-03) |
| CVE-2021-34473 | 9.1 | Microsoft Exchange — ProxyShell RCE (KEV 2021-11-03) |
| CVE-2017-0199 | 7.8 | Microsoft Office/WordPad — RTF/HTA RCE (KEV 2021-11-03) |
| CVE-2017-11882 | 7.8 | Microsoft Office Equation Editor — memory corruption RCE (KEV 2021-11-03) |
| CVE-2017-8759 | 7.8 | Microsoft .NET Framework — WSDL parser RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Compromised SOHO devices as last-hop redirectors, after compromised Australian sites as C2 (ASD's ACSC, 2024)
- Procured or leased victim-facing C2 is now used only occasionally and is in decline (ASD's ACSC and partners, 2024)
- Lookalike phishing domains; stolen data hidden by steganography in GitHub files (MITRE ATT&CK, 2026)
Reporting and advisories 4
- DoJ
Indictment — Four MSS Hainan Officers (2021) - CISA
AA24-190A — Five Eyes APT40 Advisory (2024) - ASD's ACSC + 8 partner agencies
Australian government & private-sector network intrusions (ASD-led joint advisory) - MITRE ATT&CK
Leviathan (G0065) group profile