CISA Leviathan 2024

Leviathan performed extensive remote host enumeration to build their own map of victim networks during Leviathan Australian Intrusions.

Leviathan used remote shares to move laterally through victim networks during Leviathan Australian Intrusions.

Leviathan used SSH brute force techniques to move laterally within victim environments during Leviathan Australian Intrusions.

Leviathan exfiltrated collected data over existing command and control channels during Leviathan Australian Intrusions.

Leviathan captured submitted multfactor authentication codes and other technical artifacts related to remote access sessions during Leviathan Australian Intrusions.

Leviathan exploited software vulnerabilities in victim environments to escalate privileges during Leviathan Australian Intrusions.

Leviathan stored captured credential material on local log files on victim systems during Leviathan Australian Intrusions.

Leviathan used captured, valid account information to log into victim web applications and appliances during Leviathan Australian Intrusions.

Leviathan has obtained valid accounts to gain initial access.

Leviathan compromised domain credentials during Leviathan Australian Intrusions.

Leviathan used captured local account information, such as service accounts, for actions during Leviathan Australian Intrusions.

Leviathan performed host enumeration and data gathering operations on victim machines during Leviathan Australian Intrusions.

Leviathan abused compromised appliance access to collect multifactor authentication token values during Leviathan Australian Intrusions.

Leviathan scanned and enumerated remote network shares in victim environments during Leviathan Australian Intrusions.

Leviathan has used exploits against publicly-disclosed vulnerabilities for initial access into victim networks.

Leviathan exploited public-facing web applications and appliances for initial access during Leviathan Australian Intrusions.

Leviathan exploited vulnerable network appliances during Leviathan Australian Intrusions, leading to the collection and exfiltration of valid credentials.

Leviathan gathered information from SQL servers and Building Management System (BMS) servers during Leviathan Australian Intrusions.

Leviathan performed Active Directory enumeration of victim environments during Leviathan Australian Intrusions.

Leviathan relied extensively on web shell use following initial access for persistence and command execution purposes in victim environments during Leviathan Australian Intrusions.

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.

Leviathan abused access to compromised appliances to collect JSON Web Tokens (JWTs), used for creating virtual desktop sessions, during Leviathan Australian Intrusions.

Leviathan gathered credentials hardcoded in binaries located on victim devices during Leviathan Australian Intrusions.

Leviathan gathered credentials stored in files related to Building Management System (BMS) operations during Leviathan Australian Intrusions.

Leviathan used Kerberoasting techniques during Leviathan Australian Intrusions.

Leviathan has used compromised legitimate websites as command and control nodes for operations.

Leviathan has used compromised networking devices, such as small office/home office (SOHO) devices, as operational command and control infrastructure.

Leviathan has rapidly transformed and adapted public exploit proof-of-concept code for new vulnerabilities and utilized them against target networks.

Leviathan weaponized publicly-known vulnerabilities for initial access and other purposes during Leviathan Australian Intrusions.

Leviathan enumerated compromised web application resources to identify additional endpoints and resources linkd to the website for follow-on access during Leviathan Australian Intrusions.

Leviathan has conducted reconnaissance against target networks of interest looking for vulnerable, end-of-life, or no longer maintainted devices against which to rapidly deploy exploits.

Leviathan performed extensive Active Directory enumeration of victim environments during Leviathan Australian Intrusions.

Leviathan modified system firewalls to add two open listening ports on 9998 and 9999 during Leviathan Australian Intrusions.