HAFNIUMThreat actor
- atk233
- g0125
- murky panda
- operation exchange marauder
- red dev 13
- Silk Typhoon
HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.From MISP Galaxy
Last reported 15 days ago, by Security Affairs15 reports
ATT&CK techniques
6 of 13 · each with the sentence it comes from- T1505.003Web Shell
“Once embedded, HAFNIUM resets admin accounts, deploys web shells, and abuses service principals to exfiltrate data via Microsoft Graph and Exchange Web Services.”
- T1053.005Scheduled Task
“It sets up persistence via scheduled tasks depending on the amount of privileges and integrity level, and looks to execute another obfuscated payload every 45 minutes.”
- T1195Supply Chain Compromise
“Supply chain compromise became industrialized.”
- T1684Social Engineering
“…d deliver that malware, including ones disguised as Outlook, YouTube, and LinkedIn related addresses, a small but effective bit of social engineering camouflage.”
- T1003.006DCSync
“… observed the group dropping and executing a binary called newdcsync, which, based on the command line and filename, was likely used for DCSync attacks.”
- T1021.001Remote Desktop Protocol
“We also observed the group deploying a suspected custom remote desktop protocol (RDP) launcher (under the name smss.exe) and a C# implementation of SMBExec known as Sharp-SMBExec.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
15 reports, newest first · the exact sentence from each-
US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools“State Department offered a $10 million reward for information on Zhang Yu, who is linked to the Silk Typhoon hacking group and the 2021 Microsoft Exchange Server attacks.”
-
FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions“The activity is tracked under the moniker Silk Typhoon (formerly Hafnium).”
-
US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward“Microsoft disclosed the Hafnium attacks in March 2021 and now tracks the threat actor as Silk Typhoon.”
-
U.S. Offers $10 Million Reward for Alleged HAFNIUM Hacker Zhang Yu“Offers $10 Million Reward for Alleged HAFNIUM Hacker Zhang Yu”
-
U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks“Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks”
-
MI5 Warns Over 100 Academics Helped China's Espionage Plans“…ands of workers, including many hackers that have been responsible for some of China’s most audacious campaigns, via ‘groups’ such as Silk Typhoon and Salt Typhoon.”
-
Cyber Brief 26-05 - April 2026“Alleged Silk Typhoon member extradited from Italy to the United States”
-
From ‘High/Medium/Low’ to Dollars: Making Cyber Risk Legible to Your CFO“Campaigns associated with Silk Typhoon, attacks against cloud-based identity systems, and growing software supply-chain activity demonstrated how attackers were expanding beyond traditional infrastructure.”
-
Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest“…a group of security vendors traced it to 88,000 compromised servers worldwide, tied to the Chinese state-sponsored group now known as Silk Typhoon.”
-
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia“Microsoft observed similar activity by Silk Typhoon (Hafnium).”
-
Six Supply Chain Attack Groups to Watch Out for in 2026“First identified in 2021, HAFNIUM is an espionage group linked to China that is known for becoming invisible inside cloud environments.”
-
Reconnaissance Has Begun for the New BeyondTrust RCE (CVE-2026-1731): Here's What We See So Far“It's a variant of CVE-2024-12356, the same vulnerability class that Chinese state-sponsored group Silk Typhoon used to breach the U.S.”
-
GreyNoise Detects Active Exploitation of Silk Typhoon-Linked CVEs“…d active exploitation by more than 90 unique threat IPs in the past 24 hours across CVEs linked to the Chinese cyber espionage group, Silk Typhoon (HAFNIUM).”
-
ProxyShell vs. ProxyLogon: What's the Difference?“ProxyLogon is the vulnerability that HAFNIUM unleashed in March 2021, which gave threat actors remote code execution abilities from anywhere in the world with internet access to reach the victim server.”
-
Rapid Response: Mass Exploitation of On-Prem Exchange Servers“…ses versions of Microsoft Exchange Server in what they claim are “limited and targeted attacks.” They also highlight that threat actor "HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms…”
Indicators in its reports
named in the reports above- c0cc[.]ccin 2 reports
- 4264cfb3980a068a…40e59885f5c8in 1 report
- 2e8f9fd8213d9f69…93d881c04cd2in 1 report
- 8d9433e9734dd629…d344de733c78in 1 report
- d67197bf407e74ec…7df65cf429b3in 1 report
- 141.164.46[.]77in 1 report
- 96.9.125[.]227in 1 report
- 194.38.11[.]3in 1 report
- check.office365-update[.]comin 1 report
- 209.141.40[.]254in 1 report
- zimbra-beta[.]infoin 1 report
- 17a077eab538ca80…687b573042cain 1 report
- 92d17848f4c0fd4d…abb1a39badc1in 1 report
- 18f85477f7edad2c…cc3249799cf2in 1 report
- af9fdab713ca9223…eb13efa6ef49in 1 report
- 4c77d11aeaf590e6…b46b93203c0ein 1 report
- cyberdrain[.]comin 1 report
- hxxp://p.estonine[.]com/p?ein 1 report
- p.estonine[.]comin 1 report
- hxxp://cdn.chatcdn[.]net/p?low210305in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.