HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.123
- Microsoft HAFNIUM March 2020
- Volexity Exchange Marauder March 2021
- Microsoft Silk Typhoon MAR 2025
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | HAFNIUM | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Operation Exchange Marauder | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Silk Typhoon | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1592.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1530 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.006 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1593.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.002 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1095 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2021 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.003 | 2021 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1016.001 | Internet Connection Discovery | — |
| T1018 | Remote System Discovery | — |
| T1033 | System Owner/User Discovery | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1071.001 | Web Protocols | — |
| T1078.003 | Local Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1095 | Non-Application Layer Protocol | — |
| T1098 | Account Manipulation | — |
| T1105 | Ingress Tool Transfer | — |
| T1110.003 | Password Spraying | — |
| T1114.002 | Remote Email Collection | — |
| T1119 | Automated Collection | — |
| T1132.001 | Standard Encoding | — |
| T1136.002 | Domain Account | — |
| T1190 | Exploit Public-Facing Application | — |
| T1199 | Trusted Relationship | — |
| T1213.002 | Sharepoint | — |
| T1218.011 | Rundll32 | — |
| T1505.003 | Web Shell | — |
| T1530 | Data from Cloud Storage | — |
| T1550.001 | Application Access Token | — |
| T1555.006 | Cloud Secrets Management Stores | — |
| T1560.001 | Archive via Utility | — |
| T1564.001 | Hidden Files and Directories | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1583.003 | Virtual Private Server | — |
| T1583.005 | Botnet | — |
| T1583.006 | Web Services | — |
| T1584.005 | Botnet | — |
| T1589.002 | Email Addresses | — |
| T1590 | Gather Victim Network Information | — |
| T1590.005 | IP Addresses | — |
| T1592.004 | Client Configurations | — |
| T1593.003 | Code Repositories | — |
| T1685.005 | Clear Windows Event Logs | — |
别名
HAFNIUM · Operation Exchange Marauder · Silk Typhoon
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。