Threat actor profile
A source-linked view of reported activity, targets and related automated campaign clusters.
Background and history
APT40 is a China-linked espionage group reported to target organisations connected with maritime affairs, defence, research, engineering, government and strategic infrastructure. Public reporting describes phishing and the exploitation of vulnerable internet-facing systems as recurring routes into target environments.
The group has operated for many years and is also known as Leviathan and by several vendor-specific names. Its targeting has often aligned with information useful to Chinese economic and national-security priorities, particularly in maritime and regional contexts. Naming conventions vary, so source attribution should always be read alongside the evidence.
Known aliases
APT40Leviathan
Google Threat Intelligence Group · 24 Jul 2026
Update (July 30): A table listing the new names of select prominent threat actors was appended to this post. Introduction Today, Google Threat Intelligence Group (GTIG) will begin rolling out a unified naming schema for tracking threat actors.…
