Leviathan has infected victims using watering holes.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090.003|Multi-hop Proxy|

Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

Leviathan has archived victim's data prior to exfiltration.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

Leviathan has staged data remotely prior to exfiltration.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|PRE|T1586.001|Social Media Accounts|

Leviathan has compromised social media accounts to conduct social engineering attacks.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|