MITRE ATT&CKgroup
G0125 HAFNIUM
- Domain
- enterprise
- Aliases
- Operation Exchange Marauder, Silk Typhoon
- Version
- 3.0
- Created
- 2021-03-03
Description
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.
Related
Uses · MITRE ATT&CK (50)
- T1685.005 Clear Windows Event Logs sub-technique
- S1155 Covenant software (tool)
- T1555.006 Cloud Secrets Management Stores sub-technique
- T1593.003 Code Repositories sub-technique
- S1011 Tarrask software (malware)
- T1016.001 Internet Connection Discovery sub-technique
- T1589.002 Email Addresses sub-technique
- T1590 Gather Victim Network Information technique
- T1590.005 IP Addresses sub-technique
- T1592.004 Client Configurations sub-technique
- T1583.003 Virtual Private Server sub-technique
- T1583.005 Botnet sub-technique
- T1583.006 Web Services sub-technique
- T1584.005 Botnet sub-technique
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1078.003 Local Accounts sub-technique
- T1078.004 Cloud Accounts sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1560.001 Archive via Utility sub-technique
- T1114.002 Remote Email Collection sub-technique
- T1213.002 Sharepoint sub-technique
- T1003.001 LSASS Memory sub-technique
- T1003.003 NTDS sub-technique
- T1110.003 Password Spraying sub-technique
- T1550.001 Application Access Token sub-technique
- T1136.002 Domain Account sub-technique
References
- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/ Volexity Exchange Marauder March 2021
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/ Microsoft Silk Typhoon MAR 2025
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ Microsoft HAFNIUM March 2020