Rising Tide Redux: Leviathan's Supply Chain Attacks & Kinetic Naval Intervention
summary
Leviathan, a Chinese APT tied to the MSS per the DOJ indictment, conducts persistent supply‑chain phishing against South China Sea naval and energy projects, with two detailed cases: June 2, 2021 targeting the Cassowary gas‑field supply chain (construction began June 1) and March 2022 targeting a European supplier for a Taiwanese offshore wind farm. Campaigns use RTF template injection, embed hard‑coded victim IDs, return ZIPs with DLL staggers that deploy XOR‑encoded shellcode and phone home to C2; coast guard harassment follows days later, suggesting MSS‑supported gray‑zone maritime intelligence for kinetic intervention.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:04Collaborators and context
- 2:04Agenda
- 3:07Who Leviathan is
- 5:38Hainan and naval ops
- 7:03South China Sea claims
- 8:28Leviathan’s phishing timeline
- 9:31Offshore energy in Malaysia
- 11:39Attribution and TTPs
- 13:24Cyber to kinetic link
- 14:30Cassowary gas field campaign
- 16:00End intelligence customer
- 17:24Coast Guard intervention
- 18:46Coast Guard harassment
- 19:49Taiwan wind farm attack
- 21:34Why Leviathan supports these operations
- 22:57Gray Zone strategy
- 23:40Conclusion and impact
- 24:23Q&A
related talks
45mHiding in Plain Sight: Hunting Volt Typhoon Cyber Actors
27mA Supply Chain Incident of Major Influence in Israel
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
52mLessons Learned from the Summer of Supply Chain Attacks
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
55mRevealing the Attack Operations Targeting Japan
51mThe Enemy Within: Modern Supply Chain Attacks