NanHaiShu

NanHaiShu is a remote access tool and JScript backdoor used by Leviathan. NanHaiShu has been used to target government and private-sector organizations that have relations to the South China Sea dispute.

View graph Watch Export

Indicators tracked

Intelligence Reports20

20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

13 relationships

T1033: System Owner/User Discovery

source

T1027.013: Encrypted/Encoded File

source

T1059.007: JavaScript

source

T1071.004: DNS

source

T1082: System Information Discovery

source

T1016: System Network Configuration Discovery

source

T1218.005: Mshta

source

T1547.001: Registry Run Keys / Startup Folder

source

T1685: Disable or Modify Tools

source

T1070.004: File Deletion

source

T1059.005: Visual Basic

source

T1105: Ingress Tool Transfer

source