Procedure examples

Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.

Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.

Leviathan has targeted RDP credentials and used it to move through the victim environment.

Leviathan used ssh for internal reconnaissance.

Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.

Leviathan has used steganography to hide stolen data inside other files stored on Github.

Leviathan has obfuscated code using base64.

Leviathan has obfuscated code using gzip compression.

Leviathan has exfiltrated data over its C2 channel.

Leviathan has used WMI for execution.

Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.

Leviathan has used PowerShell for execution.

Leviathan has used VBScript.

Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.

Leviathan has staged data remotely prior to exfiltration.

Leviathan has obtained valid accounts to gain initial access.

Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.

Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.

Leviathan has downloaded additional scripts and files from adversary-controlled servers.

Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.

Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.

Leviathan has infected victims using watering holes.

Leviathan has used exploits against publicly-disclosed vulnerabilities for initial access into victim networks.

Leviathan has used BITSAdmin to download additional tools.

Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.

Leviathan has sent spearphishing email links attempting to get a user to click.

Leviathan has sent spearphishing attachments attempting to get a user to click.

Leviathan has used regsvr32 for execution.

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.

Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.

Leviathan has used WMI for persistence.

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.

Leviathan has used stolen code signing certificates to sign malware.

Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.

Leviathan has archived victim's data prior to exfiltration.

Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.

Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.

Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.

Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.

Leviathan has established domains that impersonate legitimate entities to use for targeting efforts.

Leviathan has used compromised legitimate websites as command and control nodes for operations.

Leviathan has used compromised networking devices, such as small office/home office (SOHO) devices, as operational command and control infrastructure.

Leviathan has created new social media accounts for targeting efforts.

Leviathan has created new email accounts for targeting efforts.

Leviathan has compromised social media accounts to conduct social engineering attacks.

Leviathan has compromised email accounts to conduct social engineering attacks.

Leviathan has rapidly transformed and adapted public exploit proof-of-concept code for new vulnerabilities and utilized them against target networks.

Leviathan has collected compromised credentials to use for targeting efforts.

Leviathan has conducted reconnaissance against target networks of interest looking for vulnerable, end-of-life, or no longer maintainted devices against which to rapidly deploy exploits.