APT40
No sourced public emblem in this profile.
reference profile · reported nexus: CN (not nationality)
Leviathan is an espionage actor targeting organizations and high-value targets in defense and government. Active since at least 2014, this actor has long-standing interest in maritime industries, naval defense contractors, and associated research institutions in the United States and Western Europe.
Source-reported aliases: TEMP.Periscope, TEMP.Jumper, Leviathan, BRONZE MOHAWK, GADOLINIUM, KRYPTONITE PANDA, G0065, ATK29, TA423, Red Ladon, ITG09, MUDCARP, ISLANDDREAMS, Gingham Typhoon, ISLAND CASTLE. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
United States of America · 
Hong Kong · 
Cambodia · 
Belgium · 
Germany · 
Philippines · 
Malaysia · 
Norway · 
Saudi Arabia · 
Switzerland · 
United Kingdom
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.cfr.org/interactive/cyber-operations/apt-40
https://www.recordedfuture.com/chinese-threat-actor-tempperiscope/
https://attack.mitre.org/groups/G0065/
https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
https://intrusiontruth.wordpress.com/2020/01/10/who-is-mr-gu
https://intrusiontruth.wordpress.com/2020/01/13/who-else-works-for-this-cover-company-network
https://intrusiontruth.wordpress.com/2020/01/14/who-is-mr-ding
https://intrusiontruth.wordpress.com/2020/01/15/hainan-xiandun-technology-company-is-apt40
https://www.secureworks.com/research/threat-profiles/bronze-mohawk
https://www.mycert.org.my/portal/advisory?id=MA-774.022020