# HAFNIUM: threat group profile

> HAFNIUM is a threat group thought to operate from China. Public reporting links it to 26 attack techniques. This free profile shows how it works, stage by stage, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/hafnium
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > HAFNIUM

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 26 (plus 20 sub-techniques) |
| Thought to operate from | China |
| Other names | 5 |
| Public reports | 25 |

## Who is HAFNIUM?

HAFNIUM is a threat group thought to operate from China. Public reporting links it to 26 attack techniques.

### Also known as

ATK233, G0125, Operation Exchange Marauder, Red Dev 13, Silk Typhoon

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology, tactics and procedures. HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA.In campaigns unrelated to these vulnerabilities, Microsoft has observed HAFNIUM interacting with victim Office 365 tenants. While they are often unsuccessful in compromising customer accounts, this reconnaissance activity helps the adversary identify more details about their targets’ environments. HAFNIUM operates primarily from leased virtual private servers (VPS) in the United States.

## How does HAFNIUM attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 26 linked to HAFNIUM. Some techniques belong to more than one stage. Public reporting also lists 20 more specific variations of them, called sub-techniques.

### 1. Research (3)

- T1589: Gather Victim Identity Information
- T1590: Gather Victim Network Information
- T1592: Gather Victim Host Information

### 2. Preparation (1)

- T1583: Acquire Infrastructure

### 3. Getting in (2)

- T1078: Valid Accounts
- T1190: Exploit Public-Facing Application

### 4. Running code (1)

- T1059: Command and Scripting Interpreter

### 5. Staying in (4)

- T1078: Valid Accounts
- T1098: Account Manipulation
- T1136: Create Account
- T1505: Server Software Component

### 6. Taking control (2)

- T1078: Valid Accounts
- T1098: Account Manipulation

### 7. Hiding (3)

- T1078: Valid Accounts
- T1218: System Binary Proxy Execution
- T1564: Hide Artifacts

### 8. Disabling defences (0)

- None linked in public reporting.

### 9. Stealing passwords (1)

- T1003: OS Credential Dumping

### 10. Looking around (5)

- T1016: System Network Configuration Discovery
- T1018: Remote System Discovery
- T1033: System Owner/User Discovery
- T1057: Process Discovery
- T1083: File and Directory Discovery

### 11. Spreading (0)

- None linked in public reporting.

### 12. Gathering data (3)

- T1005: Data from Local System
- T1114: Email Collection
- T1560: Archive Collected Data

### 13. Keeping contact (4)

- T1071: Application Layer Protocol
- T1095: Non-Application Layer Protocol
- T1105: Ingress Tool Transfer
- T1132: Data Encoding

### 14. Taking data out (1)

- T1567: Exfiltration Over Web Service

### 15. Causing damage (0)

- None linked in public reporting.

## Public reports about HAFNIUM

- https://attack.mitre.org/groups/G0125/
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers
- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
- https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html
- https://www.reddit.com/r/msp/comments/lwmo5c/mass_exploitation_of_onprem_exchange_servers
- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day
- https://twitter.com/ESETresearch/status/1366862946488451088
- https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html
- https://us-cert.cisa.gov/ncas/alerts/aa21-062a
- https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289
- https://github.com/microsoft/CSS-Exchange/tree/main/Security
- https://github.com/cert-lv/exchange_webshell_detection
- https://www.crowdstrike.com/blog/falcon-complete-stops-microsoft-exchange-server-zero-day-exploits
- https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021
- https://pastebin.com/J4L3r2RS
- https://www.huntress.com/blog/rapid-response-mass-exploitation-of-on-prem-exchange-servers
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Execution/exchange-iis-worker-dropping-webshell.md
- https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server
- https://www.nextron-systems.com/2021/03/06/scan-for-hafnium-exploitation-evidence-with-thor-lite
- https://www.thedailybeast.com/how-chinas-devastating-microsoft-hack-puts-us-all-at-risk
- https://www.rnz.co.nz/news/political/447239/government-points-finger-at-china-over-cyber-attacks
- https://www.gov.uk/government/news/uk-and-allies-hold-chinese-state-responsible-for-a-pervasive-pattern-of-hacking
- https://www.foreignminister.gov.au/minister/marise-payne/media-release/australia-joins-international-partners-attribution-malicious-cyber-activity-china
- https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf

## Frequently asked questions

### Who is HAFNIUM?

HAFNIUM is a threat group thought to operate from China. Public reporting links it to 26 attack techniques.

### Where is HAFNIUM thought to be based?

Public reporting places HAFNIUM as operating from China. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### How does HAFNIUM attack?

Public reporting links HAFNIUM to 26 attack techniques. Most of them are about looking around, staying in and keeping contact.

### How do I know if HAFNIUM is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact