Leviathan has obtained valid accounts to gain initial access.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Office 365,SaaS,Google Workspace|T1534|Internal Spearphishing|

Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|

Leviathan has compromised email accounts to conduct social engineering attacks.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

Leviathan has used steganography to hide stolen data inside other files stored on Github.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Leviathan has established domains that impersonate legitimate entities to use for targeting efforts. (Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)|
|mitre-attack|enterprise-attack|PRE|T1589.001|Credentials|

Leviathan has collected compromised credentials to use for targeting efforts.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|PRE|T1585.001|Social Media Accounts|

Leviathan has created new social media accounts for targeting efforts.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|

Leviathan has created new email accounts for targeting efforts.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|