HAFNIUM
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.
- ATT&CK ID
- G0125
- Origin
- China
- Weather family
- Typhoon
- Techniques
- 37
- Tools
- 6
Also tracked as Operation Exchange Marauder · Silk Typhoon
Techniques
Reconnaissance
Gather Victim Identity InformationGather Victim Network InformationGather Victim Host InformationSearch Open Websites/Domains
Resource Development
Acquire InfrastructureCompromise Infrastructure
Initial Access
Valid AccountsExploit Public-Facing ApplicationTrusted Relationship
Execution
Command and Scripting Interpreter
Persistence
Valid AccountsAccount ManipulationCreate AccountServer Software Component
Privilege Escalation
Exploitation for Privilege EscalationValid AccountsAccount Manipulation
Stealth
Valid AccountsSystem Binary Proxy ExecutionHide Artifacts
Defense Impairment
Credential Access
OS Credential DumpingBrute ForceCredentials from Password Stores
Discovery
System Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoveryProcess DiscoveryFile and Directory Discovery
Lateral Movement
Use Alternate Authentication Material
Collection
Data from Local SystemEmail CollectionAutomated CollectionData from Information RepositoriesData from Cloud StorageArchive Collected Data
Command and Control
Application Layer ProtocolNon-Application Layer ProtocolIngress Tool TransferData Encoding
Exfiltration
Software
ASPXSpy · China Chopper · Covenant · Impacket · PsExec · Tarrask