Início / Grupos de ameaça / HAFNIUM

HAFNIUM G0125

🔔 Criar alerta

Também conhecido como: Operation Exchange Marauder, Silk Typhoon

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

0

CVEs associadas

51

Técnicas

6

Malwares e ferramentas

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Reconhecimento

T1589.002 Email Addresses T1590 Gather Victim Network Information T1590.005 IP Addresses T1592.004 Client Configurations T1593.003 Code Repositories

Desenvolvimento de recursos

T1583.003 Virtual Private Server T1583.005 Botnet T1583.006 Web Services T1584.005 Botnet

Acesso inicial

T1078.003 Local Accounts T1078.004 Cloud Accounts T1190 Exploit Public-Facing Application T1199 Trusted Relationship

Execução

T1059.001 PowerShell T1059.003 Windows Command Shell

Persistência

T1078.003 Local Accounts T1078.004 Cloud Accounts T1098 Account Manipulation T1136.002 Domain Account T1505.003 Web Shell

Escalada de privilégios

T1068 Exploitation for Privilege Escalation T1078.003 Local Accounts T1078.004 Cloud Accounts T1098 Account Manipulation

Furtividade

T1078.003 Local Accounts T1078.004 Cloud Accounts T1218.011 Rundll32 T1564.001 Hidden Files and Directories

Comprometimento de defesas

T1685.005 Clear Windows Event Logs

Acesso a credenciais

T1003.001 LSASS Memory T1003.003 NTDS T1110.003 Password Spraying T1555.006 Cloud Secrets Management Stores

Descoberta

T1016 System Network Configuration Discovery T1016.001 Internet Connection Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1083 File and Directory Discovery

Movimento lateral

T1550.001 Application Access Token

Coleta

T1005 Data from Local System T1114.002 Remote Email Collection T1119 Automated Collection T1213.002 Sharepoint T1530 Data from Cloud Storage T1560.001 Archive via Utility

Comando e controle

T1071.001 Web Protocols T1095 Non-Application Layer Protocol T1105 Ingress Tool Transfer T1132.001 Standard Encoding

Exfiltração

T1567.002 Exfiltration to Cloud Storage

Malwares e ferramentas

ASPXSpyMalwareS0073
China ChopperMalwareS0020
TarraskMalwareS1011
CovenantFerramentaS1155
ImpacketFerramentaS0357
PsExecFerramentaS0029

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.