How can organisations defend against Leviathan?

How Leviathan-style intrusion campaigns succeed

leviathan-style activity tends to blend phishing, malware delivery, and remote access into ordinary business traffic, so the first defensive question is whether your environment can distinguish legitimate administration from attacker-controlled execution. The practical problem is not just initial compromise, but the ability of a stolen account or implanted tool to keep operating without drawing attention.

That means defenders need to look at the full intrusion chain, from initial lure to post-compromise use of the account. MITRE ATT&CK Enterprise Matrix is useful here because it helps map credential access, persistence, lateral movement, and privilege escalation into the same detection story.

For the same reason, baseline hygiene matters more than one-off signatures. Strong endpoint hardening, script control, and attachment handling reduce the number of easy execution paths an operator can use after the first click or login.

Which controls matter most for prevention

The most effective controls are the ones that reduce both delivery success and post-exploitation reach. Hardened endpoints, restricted scripting, tight remote access rules, and phishing-resistant authentication make it harder for an attacker to turn a single mailbox or desktop compromise into broader access.

Detection should focus on the behaviours that usually follow a successful intrusion, especially archive abuse, credential theft, and repeated outbound connections to unexpected destinations. Those signs often matter more than the original lure because they reveal whether the campaign is still in the delivery stage or has already moved into hands-on-keyboard activity.

NIST SP 800-63 Digital Identity Guidelines is relevant because phishing-resistant authentication materially raises the cost of account takeover and limits the value of stolen passwords in remote-access abuse.

NIST Cybersecurity Framework 2.0 also fits this problem because the defence spans identify, protect, detect, respond, and recover activities rather than a single control family.

What to investigate after suspicious activity appears

Once you see suspicious remote access, the priority is to determine whether the account was merely probed or actually used for persistence and movement. Check for unusual outbound connections, login geolocation anomalies, new persistence artefacts, and whether the same account is touching mail, file shares, admin tools, or sensitive business systems.

NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant because its access control, audit, configuration, and integrity controls support the investigation and containment workflow.

CIS Benchmarks are also useful when the campaign depends on weak system configuration, exposed services, or overly permissive host settings that make post-exploitation easier.

Risk and Threat Considerations

Leviathan-style campaigns are dangerous because they convert ordinary trust relationships, email delivery, and remote access into a stealthy route to business systems. If defenders only watch for malware execution, they can miss the later stage where the attacker uses a legitimate account to move laterally, steal data, or maintain access.

Failure mechanism: The campaign succeeds when phishing, malware delivery, or remote access lands on a system that still allows broad execution, weak monitoring, or privileged follow-on access. At that point the intrusion becomes difficult to separate from normal administration.

Impact: The result can be account compromise, broader internal movement, sensitive data exposure, and repeated targeting of business, maritime, or government systems through the same compromised foothold.

Practitioner Guidance

What to verify: Confirm whether remote access paths, scripting, and attachment handling are actually restricted in production, not just documented. If users or service accounts can still reach sensitive systems from untrusted endpoints, the campaign can progress even when the original phishing attempt is detected.

Decision rule: If you see abnormal outbound traffic plus authenticated access from an unusual session, treat it as potential compromise first and validation second. Rotate or revoke the affected access path before relying on host-based cleanup alone.

Practitioner takeaway: The main defensive win is to deny the attacker a second stage, not just to block the first lure, so verify that hardening, authentication, and monitoring work together under real compromise conditions.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• How can organisations defend against Leviathan Australian intrusions?
• How should organisations defend against attack-as-a-service identity fraud?
• How should organisations defend biometric authentication against spoofing attacks?
• How should organisations defend against business email compromise when attackers use real conversations?