HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.123
- Microsoft HAFNIUM March 2020
- Volexity Exchange Marauder March 2021
- Microsoft Silk Typhoon MAR 2025
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1592.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1530 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.006 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1593.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1095 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1016.001 | Internet Connection Discovery | — |
| T1018 | Remote System Discovery | — |
| T1033 | System Owner/User Discovery | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1071.001 | Web Protocols | — |
| T1078.003 | Local Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1095 | Non-Application Layer Protocol | — |
| T1098 | Account Manipulation | — |
| T1105 | Ingress Tool Transfer | — |
| T1110.003 | Password Spraying | — |
| T1114.002 | Remote Email Collection | — |
| T1119 | Automated Collection | — |
| T1132.001 | Standard Encoding | — |
| T1136.002 | Domain Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1199 | Trusted Relationship | — |
| T1213.002 | Sharepoint | — |
| T1218.011 | Rundll32 | — |
| T1505.003 | Web Shell | — |
| T1530 | Data from Cloud Storage | — |
| T1550.001 | Application Access Token | — |
| T1555.006 | Cloud Secrets Management Stores | — |
| T1560.001 | Archive via Utility | — |
| T1564.001 | Hidden Files and Directories | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1583.003 | Virtual Private Server | — |
| T1583.005 | Botnet | — |
| T1583.006 | Web Services | — |
| T1584.005 | Botnet | — |
| T1589.002 | Email Addresses | — |
| T1590 | Gather Victim Network Information | — |
| T1590.005 | IP Addresses | — |
| T1592.004 | Client Configurations | — |
| T1593.003 | Code Repositories | — |
| T1685.005 | Clear Windows Event Logs | — |
Aliases
HAFNIUM · Operation Exchange Marauder · Silk Typhoon
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.