CVE Intelligence
Home / Threat actors / HAFNIUM

HAFNIUM G0125

🔔 Create alert

Also known as: Operation Exchange Marauder, Silk Typhoon

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
51
Techniques
6
Malware and tools

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance
T1589.002 Email AddressesT1590 Gather Victim Network InformationT1590.005 IP AddressesT1592.004 Client ConfigurationsT1593.003 Code Repositories
Resource Development
T1583.003 Virtual Private ServerT1583.005 BotnetT1583.006 Web ServicesT1584.005 Botnet
Initial Access
T1078.003 Local AccountsT1078.004 Cloud AccountsT1190 Exploit Public-Facing ApplicationT1199 Trusted Relationship
Execution
T1059.001 PowerShellT1059.003 Windows Command Shell
Persistence
T1078.003 Local AccountsT1078.004 Cloud AccountsT1098 Account ManipulationT1136.002 Domain AccountT1505.003 Web Shell
Privilege Escalation
T1068 Exploitation for Privilege EscalationT1078.003 Local AccountsT1078.004 Cloud AccountsT1098 Account Manipulation
Stealth
T1078.003 Local AccountsT1078.004 Cloud AccountsT1218.011 Rundll32T1564.001 Hidden Files and Directories
Defense Impairment
T1685.005 Clear Windows Event Logs
Credential Access
T1003.001 LSASS MemoryT1003.003 NTDST1110.003 Password SprayingT1555.006 Cloud Secrets Management Stores
Discovery
T1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1057 Process DiscoveryT1083 File and Directory Discovery
Lateral Movement
T1550.001 Application Access Token
Collection
T1005 Data from Local SystemT1114.002 Remote Email CollectionT1119 Automated CollectionT1213.002 SharepointT1530 Data from Cloud StorageT1560.001 Archive via Utility
Command and Control
T1071.001 Web ProtocolsT1095 Non-Application Layer ProtocolT1105 Ingress Tool TransferT1132.001 Standard Encoding
Exfiltration
T1567.002 Exfiltration to Cloud Storage

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.