HAFNIUM
Also known as:Operation Exchange Marauder · Silk Typhoon
Overview
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.
Naming & attribution
HAFNIUM is tracked under 3 names across the industry. It uses 44 documented ATT&CK techniques — more than 79% of the 174 groups tracked here.
| Name | First reported by |
|---|---|
| Operation Exchange Marauder | Gruzweig, J. et al |
| Silk Typhoon | Microsoft |
Distinctive techniques
Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.
T1592.004Client Configurations — used by 1 of 174 groupsT1550.001Application Access Token — used by 2 of 174 groupsT1555.006Cloud Secrets Management Stores — used by 2 of 174 groupsT1583.005Botnet — used by 3 of 174 groupsT1590Gather Victim Network Information — used by 3 of 174 groupsT1590.005IP Addresses — used by 3 of 174 groupsT1593.003Code Repositories — used by 3 of 174 groups
Closest groups by technique overlap
Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.
- Ke3chang China — 18 shared techniques (25% overlap)
- APT28 Russia — 25 shared techniques (22% overlap)
- Play — 12 shared techniques (21% overlap)
- Magic Hound Iran — 20 shared techniques (20% overlap)
- Chimera China — 17 shared techniques (20% overlap)
- Volt Typhoon China — 20 shared techniques (19% overlap)
Capabilities
- Exploitation of public-facing / client applications — ATT&CK T1190
- Custom malware/implant development — ATT&CK: 3 attributed custom malware families
TTPs — 44 techniques across 14 tactics
Reconnaissance
T1589.002Email AddressesT1590Gather Victim Network InformationT1590.005IP AddressesT1592.004Client ConfigurationsT1593.003Code Repositories
Resource Development
T1583.003Virtual Private ServerT1583.005BotnetT1583.006Web ServicesT1584.005Botnet
Initial Access
Execution
T1059.001PowerShellT1059.003Windows Command Shell
Persistence
T1098Account ManipulationT1136.002Domain AccountT1505.003Web Shell
Privilege Escalation
Stealth
T1078.003Local AccountsT1078.004Cloud AccountsT1218.011Rundll32T1564.001Hidden Files and Directories
Defense Impairment
T1685.005Clear Windows Event Logs
Credential Access
T1003.001LSASS MemoryT1003.003NTDST1110.003Password SprayingT1555.006Cloud Secrets Management Stores
Discovery
Lateral Movement
T1550.001Application Access Token
Collection
T1005Data from Local SystemT1114.002Remote Email CollectionT1119Automated CollectionT1213.002SharepointT1530Data from Cloud StorageT1560.001Archive via Utility
Command and Control
T1071.001Web ProtocolsT1095Non-Application Layer ProtocolT1105Ingress Tool TransferT1132.001Standard Encoding
Exfiltration
T1567.002Exfiltration to Cloud Storage
Tools & malware (6)
Tarrask · ASPXSpy · Impacket · PsExec · Covenant · China Chopper
Reporting (3)
- Silk Typhoon targeting IT supply chain — Microsoft Threat Intelligence
- How Microsoft names threat actors — Microsoft
- Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities — Gruzweig, J. et al