HAFNIUM

Threat Actors · HAFNIUM

· ATT&CK GroupG0125

Operation Exchange MarauderSilk Typhoon

Techniques

Software

Tactics

Aliases

Description

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: Microsoft Silk Typhoon MAR 2025)

Tactic Coverage

collection (6)discovery (6)persistence (5)reconnaissance (5)credential access (4)privilege escalation (4)command and control (4)stealth (4)initial access (4)resource development (4)execution (2)lateral movement (1)exfiltration (1)defense impairment (1)

Techniques Used (44)

T1003.001LSASS Memory

credential access

T1003.003NTDS

credential access

T1005Data from Local System

collection

T1016System Network Configuration Discovery

discovery

T1016.001Internet Connection Discovery

discovery

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 44 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (6)

S0073ASPXSpymalware S0020China Choppermalware S1155Covenanttool S0357Impackettool S0029PsExectool S1011Tarraskmalware

References (7)

https://attack.mitre.org/groups/G0125 https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/