Loading threat actor…
APT30, also known as Leafhopper, is a China-linked espionage threat actor. It is associated with cyber operations aligned with intelligence collection objectives rather than financially motivated crime. In the available reporting here, Leafhopper is referenced only because tooling associated with the group was observed targeting one of the same organizations during the same period as a separate espionage campaign in Southeast Asia. However, there is no evidence linking APT30 itself to that campaign. Based on the supplied facts, the only high-confidence characterization is that Leafhopper is a China-linked threat actor also known as APT30.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as a possible attribution clue because a victim was also targeted by a tool associated with this group during the same period; the content explicitly states there is no evidence tying Leafhopper to this campaign.
Mentioned only as a possible attribution clue because one victim was also targeted by a tool associated with the group; the content explicitly states there is no evidence tying Leafhopper to this campaign.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.