HAFNIUM

Also known as ATK233, G0125, Operation Exchange Marauder, Red Dev 13, Silk Typhoon, MURKY PANDA

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology, tactics and procedures. HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA.In campaigns unrelated to these vulnerabilities, Microsoft has observed HAFNIUM interacting with victim Office 365 tenants. While they are often unsuccessful in compromising customer accounts, this reconnaissance activity helps the adversary identify more details about their targets’ environments. HAFNIUM operates primarily from leased virtual private servers (VPS) in the United States.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1003.003 NTDS T1005 Data from Local System T1016 System Network Configuration Discovery T1016.001 Internet Connection Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1059.001 PowerShell T1059.003 Windows Command Shell T1068 Exploitation for Privilege Escalation T1071.001 Web Protocols T1078.003 Local Accounts T1078.004 Cloud Accounts T1083 File and Directory Discovery T1095 Non-Application Layer Protocol T1098 Account Manipulation T1105 Ingress Tool Transfer T1110.003 Password Spraying T1114.002 Remote Email Collection T1119 Automated Collection T1132.001 Standard Encoding T1136.002 Domain Account T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1213.002 Sharepoint T1218.011 Rundll32 T1505.003 Web Shell T1530 Data from Cloud Storage T1550.001 Application Access Token T1555.006 Cloud Secrets Management Stores T1560.001 Archive via Utility T1564.001 Hidden Files and Directories T1567.002 Exfiltration to Cloud Storage T1583.003 Virtual Private Server T1583.005 Botnet T1583.006 Web Services T1584.005 Botnet T1589.002 Email Addresses T1590 Gather Victim Network Information T1590.005 IP Addresses T1592.004 Client Configurations T1593.003 Code Repositories T1685.005 Clear Windows Event Logs

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.