Campaign, Apr 2022 to Sep 2022.View on attack.mitre.org
Leviathan Australian Intrusions consisted of at least two long-term intrusions against victims in Australia by Leviathan, relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. Leviathan Australian Intrusions were focused on exfiltrating sensitive data including valid credentials for the victim organizations.
| Technique | Procedure example |
|---|---|
| T1018 Remote System Discovery |
Leviathan performed extensive remote host enumeration to build their own map of victim networks during Leviathan Australian Intrusions. |
| T1021.002 SMB/Windows Admin Shares |
Leviathan used remote shares to move laterally through victim networks during Leviathan Australian Intrusions. |
| T1021.004 SSH |
Leviathan used SSH brute force techniques to move laterally within victim environments during Leviathan Australian Intrusions. |
| T1041 Exfiltration Over C2 Channel |
Leviathan exfiltrated collected data over existing command and control channels during Leviathan Australian Intrusions. |
| T1056 Input Capture |
Leviathan captured submitted multfactor authentication codes and other technical artifacts related to remote access sessions during Leviathan Australian Intrusions. |
| T1068 Exploitation for Privilege Escalation |
Leviathan exploited software vulnerabilities in victim environments to escalate privileges during Leviathan Australian Intrusions. |
| T1074.001 Local Data Staging |
Leviathan stored captured credential material on local log files on victim systems during Leviathan Australian Intrusions. |
| T1078 Valid Accounts |
Leviathan used captured, valid account information to log into victim web applications and appliances during Leviathan Australian Intrusions. |
| T1078.002 Domain Accounts |
Leviathan compromised domain credentials during Leviathan Australian Intrusions. |
| T1078.003 Local Accounts |
Leviathan used captured local account information, such as service accounts, for actions during Leviathan Australian Intrusions. |
| T1082 System Information Discovery |
Leviathan performed host enumeration and data gathering operations on victim machines during Leviathan Australian Intrusions. |
| T1111 Multi-Factor Authentication Interception |
Leviathan abused compromised appliance access to collect multifactor authentication token values during Leviathan Australian Intrusions. |
| T1135 Network Share Discovery |
Leviathan scanned and enumerated remote network shares in victim environments during Leviathan Australian Intrusions. |
| T1190 Exploit Public-Facing Application |
Leviathan exploited public-facing web applications and appliances for initial access during Leviathan Australian Intrusions. |
| T1212 Exploitation for Credential Access |
Leviathan exploited vulnerable network appliances during Leviathan Australian Intrusions, leading to the collection and exfiltration of valid credentials. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
