Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · HAFNIUM · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

HAFNIUM

  • ATK233
  • G0125
  • Operation Exchange Marauder
  • Red Dev 13
  • Silk Typhoon
  • MURKY PANDA

attribution confidence 100/100 (source-stated)MITRE G0125 ↗

HAFNIUM — ATT&CK roseHA

attack rose · 44 techniques across 14 tactics

Last 30 days

last seen 8 d ago
dispatches6
victims0
CVEs seen0

What changed

ledger · newest first
  1. —todaynew CVE8 new CVEs: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065, CVE-2023-3519, CVE-2024-12356 +2 more
  2. —9 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology, tactics and procedures. HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control.

In campaigns unrelated to these vulnerabilities, Microsoft has observed HAFNIUM interacting with victim Office 365 tenants. While they are often unsuccessful in compromising customer accounts, this reconnaissance activity helps the adversary identify more details about their targets’ environments. HAFNIUM operates primarily from leased virtual private servers (VPS) in the United States.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

44 techniques · 14 of 15 tactics

  1. Reconnaissance

    5 techniques

  2. Resource development

    4 techniques

  3. Initial access

    2 techniques

  4. Execution

    2 techniques

  5. Persistence

    3 techniques

  6. Privilege escalation

    1 technique

  7. Stealth

    4 techniques

  8. Defense impairment

    1 technique

  9. Credential access

    4 techniques

  10. Discovery

    6 techniques

  11. Lateral movement

    1 technique

  12. Collection

    6 techniques

  13. Command and control

    4 techniques

  14. Exfiltration

    1 technique

select a technique

Arsenal

3 malware · 3 tools
Malware
Malware · 3ATT&CK
TarraskS1011 ↗
ASPXSpyS0073 ↗
China ChopperS0020 ↗
Tools
Tools · 3ATT&CK
ImpacketS0357 ↗
PsExecS0029 ↗
CovenantS1155 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs HAFNIUM is cited as exploiting

2 on CISA KEV
  1. CVE-2024-3400KEV2026-10-17
    1. “In March 2024, Silk Typhoon used a zero-day exploit for CVE-2024-3400 in GlobalProtect Gateway on Palo Alto Networks firewalls to compromise multiple organizations:”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

  2. CVE-2025-0282KEV2026-10-17
    1. “In January 2025, Silk Typhoon was also observed exploiting a zero-day vulnerability in the public facing Ivanti Pulse Connect VPN ( CVE-2025-0282 ).”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

  3. CVE-2021-270652026-10-17
    1. “CVE-2021-27065 – A post-authentication arbitrary file write vulnerability in Exchange. If Silk Typhoon could authenticate with the Exchange server, then it could use this vulnerability to write a file to any path on the server.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “CVE-2021-27065 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    3. “Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server.”

      cited as exploiting · named nearby · source: splunk.com ↗ · 2026-10-17

  4. CVE-2021-268582026-10-17
    1. “CVE-2021-26858 – A post-authentication arbitrary file write vulnerability in Exchange. If Silk Typhoon could authenticate with the Exchange server, then it could use this vulnerability to write a file to any path on the server.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “CVE-2021-26858 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    3. “Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server.”

      cited as exploiting · named nearby · source: splunk.com ↗ · 2026-10-17

  5. CVE-2023-35192026-10-17
    1. “In early 2024, Microsoft began to observe Silk Typhoon compromising zero-day vulnerabilities within Citrix NetScaler ADC and NetScaler Gateways: CVE-2023-3519”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

  6. CVE-2021-268572026-10-17
    1. “Three additional vulnerabilities (CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) were also identified as part of this activity. When chained together along with CVE-2021-26855 for initial access, the attacker would have complete control over the Exchange server.”

      cited as exploiting · named nearby · source: splunk.com ↗ · 2026-10-17

  7. CVE-2021-268552026-10-17
    1. “the first vulnerability (CVE-2021-26855) has a remote network attack vector that allows the attacker, a group Microsoft named HAFNIUM, to authenticate as the Exchange server.”

      cited as exploiting · source: splunk.com ↗ · 2026-10-17

    2. “It could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate administrator’s credentials.”

      cited as exploiting · named nearby · source: microsoft.com ↗ · 2026-10-17

    3. “They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.”

      cited as exploiting · named nearby · source: microsoft.com ↗ · 2026-10-17

  8. CVE-2024-123562026-10-17
    1. “Dec 2024 │ CVE-2024-12356 — Silk Typhoon breaches U.S. Treasury”

      cited as exploiting · source: greynoise.io ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2022The APT fallout of vulnerabilities such as ProxyLogon in Exchange (Hafnium), OGNL injection, and log4shellHVS Consulting ↗

Take it with you

keyless · no signup

References

29 sources
  1. 1.attack.mitre.org/groups/G0125
  2. 2.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-se…
  3. 3.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-excha…
  4. 4.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-…
  5. 5.reddit.com/r/msp/comments/lwmo5c/mass_exploitation_of_onprem_exch…
  6. 6.blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-re…
  7. 7.twitter.com/ESETresearch/status/1366862946488451088
  8. 8.fireeye.com/blog/threat-research/2021/03/detection-response-to-exp…
  9. 9.us-cert.cisa.gov/ncas/alerts/aa21-062a
  10. 10.discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289
  11. +19 more in the JSON record

Track HAFNIUM on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.