HAFNIUM

Origin🇨🇳 China

Techniques (MITRE ATT&CK)44

SourceMITRE ATT&CK

Attribution confidence: 100%

Also known as:ATK233G0125MURKY PANDAOperation Exchange MarauderRed Dev 13Silk Typhoon

About the group

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity73

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 44

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Email Addresses Gather Victim Network Information IP Addresses Client Configurations Code Repositories

Resource development

Virtual Private Server Botnet Web Services Botnet

Initial access

Exploit Public-Facing Application Trusted Relationship

Execution

PowerShell Windows Command Shell

Persistence

Account Manipulation Domain Account Web Shell

Privilege escalation

Exploitation for Privilege Escalation

Credential access

LSASS Memory NTDS Password Spraying Cloud Secrets Management Stores

Discovery

System Network Configuration Discovery Internet Connection Discovery Remote System Discovery System Owner/User Discovery Process Discovery File and Directory Discovery

Lateral movement

Application Access Token

Collection

Data from Local System Remote Email Collection Automated Collection Sharepoint Data from Cloud Storage Archive via Utility

Command and control

Web Protocols Non-Application Layer Protocol Ingress Tool Transfer Standard Encoding

Exfiltration

Exfiltration to Cloud Storage

defense-impairment

Clear Windows Event Logs

stealth

Local Accounts Cloud Accounts Rundll32 Hidden Files and Directories

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

References

HAFNIUM uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →