Home/ Threat Actors/ HAFNIUM

🌐HAFNIUM

🌐 HAFNIUM is a tracked threat actor in the Clankerusecase corpus. ??-aligned. Primary motivation: State. We map 14 detection use cases to this actor across 44 MITRE ATT&CK techniques, with 0 threat-intel articles citing them.

View full actor card → All threat actors MITRE ATT&CK group spec (G0125) ↗

14Use cases

0Articles

44Techniques

0IOCs

About this actor (MITRE)

[HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. [HAFNIUM](https://attack.mitre.org/groups/G0125) primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. [HAFNIUM](https://attack.mitre.org/groups/G0125) has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly oper

Known aliases

HAFNIUMOperation Exchange MarauderSilk Typhoon

Top techniques

T1003.001 · LSASS Memory T1003.003 · NTDS T1005 · Data from Local System

All other tracked techniques

T1016 · System Network Configuration Discovery T1016.001 · Internet Connection Discovery T1018 · Remote System Discovery T1033 · System Owner/User Discovery T1057 · Process Discovery T1059.001 · PowerShell T1059.003 · Windows Command Shell T1068 · Exploitation for Privilege Escalation T1071.001 · Web Protocols T1078.003 · Local Accounts T1078.004 · Cloud Accounts T1083 · File and Directory Discovery T1095 · Non-Application Layer Protocol T1098 · Account Manipulation T1105 · Ingress Tool Transfer T1110.003 · Password Spraying T1114.002 · Remote Email Collection T1119 · Automated Collection T1132.001 · Standard Encoding T1136.002 · Domain Account T1190 · Exploit Public-Facing Application T1199 · Trusted Relationship T1213.002 · Sharepoint T1218.011 · Rundll32 T1505.003 · Web Shell T1530 · Data from Cloud Storage T1550.001 · Application Access Token T1555.006 · Cloud Secrets Management Stores T1560.001 · Archive via Utility T1564.001 · Hidden Files and Directories T1567.002 · Exfiltration to Cloud Storage T1583.003 · Virtual Private Server T1583.005 · Botnet T1583.006 · Web Services T1584.005 · Botnet T1589.002 · Email Addresses T1590 · Gather Victim Network Information T1590.005 · IP Addresses T1592.004 · Client Configurations T1593.003 · Code Repositories T1685.005 · Clear Windows Event Logs

Detection use cases (14)

HAFNIUM/Silk Typhoon ProxyLogon webshell drop via Exchange w3wp.exe AI · profile SΣDD HAFNIUM/Silk Typhoon webshell-to-credential-theft chain (w3wp.exe spawning recon, LSASS dump, NTDS staging) AI · profile SDD Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint MITRE match Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution MITRE match Language-runtime server (node/python/java) spawns OS shell shortly after inbound request — eval / sandbox-escape exploitation chain MITRE match Linux LPE chain — anomalous algif_aead/esp4/esp6/rxrpc kernel-module load followed by same-user root transition MITRE match Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress MITRE match Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes MITRE match OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay MITRE match