HAFNIUM

Origin🇨🇳 China

Techniques (MITRE ATT&CK)44

SourceMITRE ATT&CK

Attribution confidence: 100%

Also known as:Operation Exchange MarauderSilk Typhoon

Vexday analysis

HAFNIUM é um grupo de espionagem cibernética com provável patrocínio estatal, originário da China, ativo pelo menos desde janeiro de 2021 e rastreado pela MITRE ATT&CK sob o identificador G0125. O grupo — também referenciado como Operation Exchange Marauder e Silk Typhoon — tem como alvo prioritário entidades nos Estados Unidos em setores variados, incluindo pesquisa de doenças infecciosas, escritórios de advocacia, instituições de ensino superior, contratantes de defesa, centros de pesquisa em políticas públicas e ONGs. Entre as táticas documentadas, destaca-se o uso de ferramentas de gerenciamento remoto e software em nuvem para acesso inicial, além da capacidade demonstrada de operacionalizar rapidamente exploits para vulnerabilidades identificadas em dispositivos de borda — com 2 CVEs atribuídas e 44 técnicas ATT&CK mapeadas.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity73

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 44

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Email Addresses Gather Victim Network Information IP Addresses Client Configurations Code Repositories

Resource development

Virtual Private Server Botnet Web Services Botnet

Initial access

Exploit Public-Facing Application Trusted Relationship

Execution

PowerShell Windows Command Shell

Persistence

Account Manipulation Domain Account Web Shell

Privilege escalation

Exploitation for Privilege Escalation

Credential access

LSASS Memory NTDS Password Spraying Cloud Secrets Management Stores

Discovery

System Network Configuration Discovery Internet Connection Discovery Remote System Discovery System Owner/User Discovery Process Discovery File and Directory Discovery

Lateral movement

Application Access Token

Collection

Data from Local System Remote Email Collection Automated Collection Sharepoint Data from Cloud Storage Archive via Utility

Command and control

Web Protocols Non-Application Layer Protocol Ingress Tool Transfer Standard Encoding

Exfiltration

Exfiltration to Cloud Storage

defense-impairment

Clear Windows Event Logs

stealth

Local Accounts Cloud Accounts Rundll32 Hidden Files and Directories

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV CVE-2016-6662EPSS 68%

References

HAFNIUM uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →