FORENSIA

THREAT_ACTOR · G0125

HAFNIUM

Also known as: HAFNIUM, Operation Exchange Marauder, Silk Typhoon

Profile

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.

MITRE ATT&CK ↗

Techniques

44 ATT&CK techniques attributed to this actor.

T1003.001 LSASS MemoryT1003.003 NTDST1005 Data from Local SystemT1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1057 Process DiscoveryT1059.001 PowerShellT1059.003 Windows Command ShellT1068 Exploitation for Privilege EscalationT1071.001 Web ProtocolsT1078.003 Local AccountsT1078.004 Cloud AccountsT1083 File and Directory DiscoveryT1095 Non-Application Layer ProtocolT1098 Account ManipulationT1105 Ingress Tool TransferT1110.003 Password SprayingT1114.002 Remote Email CollectionT1119 Automated CollectionT1132.001 Standard EncodingT1136.002 Domain AccountT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1213.002 SharepointT1218.011 Rundll32T1505.003 Web ShellT1530 Data from Cloud StorageT1550.001 Application Access TokenT1555.006 Cloud Secrets Management StoresT1560.001 Archive via UtilityT1564.001 Hidden Files and DirectoriesT1567.002 Exfiltration to Cloud StorageT1583.003 Virtual Private ServerT1583.005 BotnetT1583.006 Web ServicesT1584.005 BotnetT1589.002 Email AddressesT1590 Gather Victim Network InformationT1590.005 IP AddressesT1592.004 Client ConfigurationsT1593.003 Code RepositoriesT1685.005 Clear Windows Event Logs

Software

6 malware/tools attributed to this actor.

China ChopperPsExecASPXSpyImpacketTarraskCovenant

Related corpus activity

10,233 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to HAFNIUM.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-11837cve—852
cve-2026-3102cve—853
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2025-0921cve—852
cve-2013-3307cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-17456cve—851
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2016-5681cve—852
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2021-27076cve—851
cve-2025-68670cve—852
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2025-23304cve—852
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2022-47945cve—851
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,233.