Loading story…
Proofpoint reported that the espionage group Leviathan conducted sustained spearphishing campaigns against defense contractors, government agencies, universities with military ties, legal organizations, and maritime-related entities, particularly those connected to the United States, Western Europe, and South China Sea issues. The actor used malicious attachments and URLs, including exploits for CVE-2017-0199 and CVE-2017-8759, macro-enabled Office documents, and socially engineered Publisher files, while also relying on lookalike domains, stolen branding, and occasional lateral movement through compromised email accounts and servers.
A key malware family in the campaigns was NanHaiShu, a custom JavaScript-based tool also documented by MITRE ATT&CK. NanHaiShu used DNS for command-and-control, established persistence through Registry Run Keys or Startup-folder shortcuts, executed additional VBScript and JScript, downloaded payloads from remote URLs, and abused mshta.exe to proxy execution. The malware also gathered host details such as computer name, serial number, proxy settings, and username, reduced Internet Explorer security warnings, deleted decoy files to remove evidence, and encoded files with Base64 as part of the intrusion workflow.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
MITRE ATT&CK published a software entry for NanHaiShu, documenting its observed behaviors and mapping them to ATT&CK techniques. The entry describes capabilities including DNS command-and-control, persistence via Startup or Run keys, script execution, file download, discovery, and Internet Explorer setting changes.
Proofpoint published a report describing the long-running Leviathan espionage actor targeting defense, government, maritime, and military-linked organizations. The report linked the campaigns through recurring use of custom malware including NanHaiShu and Orz, along with consistent targeting and tradecraft.
On September 15 and 19, 2017, Proofpoint detected spearphishing emails targeting a US shipbuilding company and a US university research center with military ties. The lures included the subject line “Apply for internship position” and attachments such as “resume.rtf” and “ARLUAS_FieldLog_2017-08-21.doc.”
The September 2017 attachments exploited CVE-2017-8759 only five days after the vulnerability was publicly documented. In the “resume.rtf” chain, the malware retrieved a malicious SOAP WSDL definition and then downloaded a VBScript file, later establishing persistence with a Startup shortcut and downloading Cobalt Strike.
Between August 2 and 4, 2017, the actor sent spearphishing emails with malicious URLs to multiple defense contractors. Some lures abused the branding of a major military shipbuilder, and some documents exploited CVE-2017-0199 while others used Microsoft Publisher files requiring user interaction.
From February to October 2015, campaigns attributed to the actor targeted South China Sea interests including the Philippines Department of Justice, APEC organizers, and an international law firm. These campaigns used Microsoft Excel and Word documents with macros.
Proofpoint observed the espionage actor persistently targeting US universities with military interests, especially Navy-related institutions, using malicious macro-enabled Excel documents. The actor also used macro-enabled Word documents against US research and development organizations with military and intelligence ties during this period.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported a sustained spearphishing campaign linked to the **Lazarus group** that targeted Korean-speaking individuals and later people associated with U.S. defense contractors. The attackers used weaponized Microsoft Office documents with malicious VBA macros, first relying on Korean-language decoys and later shifting to English-language job descriptions and internal policy material tied to defense firms. Researchers said the activity remained active through mid-2017 and showed little operational change despite earlier public exposure. The malware and delivery chain shared multiple traits with **Operation Blockbuster** and the later **Blockbuster Sequel**, including packed payloads, fake TLS-like communications, hard-coded command-and-control infrastructure, encoded strings, cleanup batch scripts, direct IP beaconing, and overlapping macros, XOR keys, and infrastructure. Unit 42 also found reused compromised hosts serving lure files, metadata such as the author name `ISkyISea`, and evidence of an automated document weaponization process, leading researchers to assess that the operators were either the same Lazarus-linked actors or closely cooperating with them.
Aug 15, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026
A targeted spear-phishing operation used convincing decoy documents to compromise entities in Taiwan and the Vietnamese government, delivering the **Agent.NJK** backdoor and **Terminator RAT**. The attackers relied on social engineering rather than software exploits, disguising malware with Word document icons and hidden executable extensions so victims would launch the payloads themselves. Researchers found that Agent.NJK functioned as a simple HTTP backdoor and trojan proxy with hard-coded command-and-control infrastructure and signs of live operator activity, including reconnaissance commands and an apparent typo consistent with manual control. Terminator RAT was described as more feature-rich but poorly engineered, using an **XTEA**-encrypted configuration, a custom `XOR`/`ROR` network protocol, persistence through Startup Folder manipulation and delayed file moves, and a separate proxy tunnel component to move data through corporate proxies. The activity was linked to earlier reporting through reused tooling, dynamic DNS infrastructure, and command-and-control servers in the same Taiwan-based `/24` network, indicating an ongoing intrusion set marked by targeted victim selection but weak malware development, bad cryptography, and operational mistakes.
Aug 14, 2026