Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.(Citation: FireEye APT40 March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Leviathan has sent spearphishing email links attempting to get a user to click.(Citation: Proofpoint Leviathan Oct 2017)(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.(Citation: FireEye APT40 March 2019)(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Leviathan has targeted RDP credentials and used it to move through the victim environment.(Citation: FireEye APT40 March 2019) |
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

Leviathan has used publicly available tools to dump password hashes, including

HOMEFRY.(Citation: FireEye APT40 March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

Leviathan used ssh for internal reconnaissance.(Citation: FireEye APT40 March 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|