1. Home
  2. Groups
  3. HAFNIUM

HAFNIUM

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.[1][2][3]

ID: G0125
ⓘ
Associated Groups: Operation Exchange Marauder, Silk Typhoon
Contributors: Daniyal Naeem, BT Security; Matt Brenton, Zurich Insurance Group; Mayuresh Dani, Qualys; Harshal Tupsamudre, Qualys; Vinayak Wadhwa, SAFE Security
Version: 3.0
Created: 03 March 2021
Last Modified: 25 March 2025
Version Permalink

Associated Group Descriptions

Name Description
Operation Exchange Marauder

[2]
Silk Typhoon

[4][3]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1098 Account Manipulation

HAFNIUM has granted privileges to domain accounts and reset the password for default admin accounts.[2][3]
Enterprise T1583 .003 Acquire Infrastructure: Virtual Private Server

HAFNIUM has operated from leased virtual private servers (VPS) in the United States.[1]
.005 Acquire Infrastructure: Botnet

HAFNIUM has incorporated leased devices into covert networks to obfuscate communications.[3]
.006 Acquire Infrastructure: Web Services

HAFNIUM has acquired web services for use in C2 and exfiltration.[1]
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

HAFNIUM has used open-source C2 frameworks, including Covenant.[1]
Enterprise T1560 .001 Archive Collected Data: Archive via Utility

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.[1][2]
Enterprise T1119 Automated Collection

HAFNIUM has used MSGraph to exfiltrate data from email, OneDrive, and SharePoint.[3]
Enterprise T1110 .003 Brute Force: Password Spraying

HAFNIUM has gained initial access through password spray attacks.[3]
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

HAFNIUM has used the Exchange Power Shell module Set-OabVirtualDirectoryPowerShell to export mailbox data.[1][2]
.003 Command and Scripting Interpreter: Windows Command Shell

HAFNIUM has used cmd.exe to execute commands on the victim's machine.[5]
Enterprise T1584 .005 Compromise Infrastructure: Botnet

HAFNIUM has used compromised devices in covert networks to obfuscate communications.[3]
Enterprise T1136 .002 Create Account: Domain Account

HAFNIUM has created domain accounts.[2][3]
Enterprise T1555 .006 Credentials from Password Stores: Cloud Secrets Management Stores

HAFNIUM has moved laterally from on-premises environments to steal passwords from Azure key vaults.[3]
Enterprise T1132 .001 Data Encoding: Standard Encoding

HAFNIUM has used ASCII encoding for C2 traffic.[1]
Enterprise T1530 Data from Cloud Storage

HAFNIUM has exfitrated data from OneDrive.[3]
Enterprise T1213 .002 Data from Information Repositories: Sharepoint

HAFNIUM has abused compromised credentials to exfiltrate data from SharePoint.[3]
Enterprise T1005 Data from Local System

HAFNIUM has collected data and files from a compromised machine.[5][3]
Enterprise T1114 .002 Email Collection: Remote Email Collection

HAFNIUM has used web shells and MSGraph to export mailbox data.[1][2][3]
Enterprise T1567 .002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

HAFNIUM has exfiltrated data to file sharing sites, including MEGA.[1]
Enterprise T1190 Exploit Public-Facing Application

HAFNIUM has exploited multiple vulnerabilities to compromise edge devices and on-premises versions of Microsoft Exchange Server.[1][2][6][7][8][3]
Enterprise T1068 Exploitation for Privilege Escalation

HAFNIUM has targeted unpatched applications to elevate access in targeted organizations.[3]
Enterprise T1083 File and Directory Discovery

HAFNIUM has searched file contents on a compromised host.[5]
Enterprise T1592 .004 Gather Victim Host Information: Client Configurations

HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.[1]
Enterprise T1589 .002 Gather Victim Identity Information: Email Addresses

HAFNIUM has collected e-mail addresses for users they intended to target.[2]
Enterprise T1590 Gather Victim Network Information

HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.[2]
.005 IP Addresses

HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.[2]
Enterprise T1564 .001 Hide Artifacts: Hidden Files and Directories

HAFNIUM has hidden files on a compromised host.[5]
Enterprise T1070 .001 Indicator Removal: Clear Windows Event Logs

HAFNIUM has cleared actor-performed actions from logs.[3]
Enterprise T1105 Ingress Tool Transfer

HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.[1][5]

Enterprise T1095 Non-Application Layer Protocol

HAFNIUM has used TCP for C2.[1]
Enterprise T1003 .001 OS Credential Dumping: LSASS Memory

HAFNIUM has used procdump to dump the LSASS process memory.[1][2][5]
.003 OS Credential Dumping: NTDS

HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).[2][3]
Enterprise T1057 Process Discovery

HAFNIUM has used tasklist to enumerate processes.[5]
Enterprise T1018 Remote System Discovery

HAFNIUM has enumerated domain controllers using net group "Domain computers" and nltest /dclist.[5]
Enterprise T1593 .003 Search Open Websites/Domains: Code Repositories

HAFNIUM has discovered leaked corporate credentials on public repositories including GitHub.[3]
Enterprise T1505 .003 Server Software Component: Web Shell

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.[1][2][6][7][5][3]
Enterprise T1218 .011 System Binary Proxy Execution: Rundll32

HAFNIUM has used rundll32 to load malicious DLLs.[2]
Enterprise T1016 System Network Configuration Discovery

HAFNIUM has collected IP information via IPInfo.[5]
.001 Internet Connection Discovery

HAFNIUM has checked for network connectivity from a compromised host using ping, including attempts to contact google[.]com.[5]
Enterprise T1033 System Owner/User Discovery

HAFNIUM has used whoami to gather user information.[5]
Enterprise T1199 Trusted Relationship

HAFNIUM has used stolen API keys and credentials associatd with privilege access management (PAM), cloud app providers, and cloud data management companies to access downstream customer environments.[3]
Enterprise T1550 .001 Use Alternate Authentication Material: Application Access Token

HAFNIUM has abused service principals with administrative permissions for data exfiltration.[3]
Enterprise T1078 .003 Valid Accounts: Local Accounts

HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.[6]
.004 Valid Accounts: Cloud Accounts

HAFNIUM has abused service principals in compromised environments to enable data exfiltration.[3]

Software

ID Name References Techniques
S0073 ASPXSpy [2] Server Software Component: Web Shell
S0020 China Chopper [2][6][5] Application Layer Protocol: Web Protocols, Brute Force: Password Guessing, Command and Scripting Interpreter: Windows Command Shell, Data from Local System, File and Directory Discovery, Indicator Removal: Timestomp, Ingress Tool Transfer, Network Service Discovery, Obfuscated Files or Information: Software Packing, Server Software Component: Web Shell
S1155 Covenant HAFNIUM used Covenant for command and control following compromise of internet-facing servers.[1][3] Application Layer Protocol: Web Protocols, Command and Scripting Interpreter: PowerShell, Command and Scripting Interpreter: Windows Command Shell, Encrypted Channel: Asymmetric Cryptography, Non-Standard Port, System Binary Proxy Execution: Regsvr32, System Binary Proxy Execution: InstallUtil, System Binary Proxy Execution: Mshta, System Information Discovery, Windows Management Instrumentation
S0357 Impacket [7] Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Lateral Tool Transfer, Network Sniffing, OS Credential Dumping: NTDS, OS Credential Dumping: LSASS Memory, OS Credential Dumping: Security Account Manager, OS Credential Dumping: LSA Secrets, Steal or Forge Kerberos Tickets: Kerberoasting, Steal or Forge Kerberos Tickets: Ccache Files, System Services: Service Execution, Windows Management Instrumentation
S0029 PsExec [2] Create Account: Domain Account, Create or Modify System Process: Windows Service, Lateral Tool Transfer, Remote Services: SMB/Windows Admin Shares, System Services: Service Execution
S1011 Tarrask [7] Access Token Manipulation: Token Impersonation/Theft, Command and Scripting Interpreter: Windows Command Shell, Hide Artifacts, Masquerading: Match Legitimate Resource Name or Location, Masquerading: Masquerade Task or Service, Modify Registry, Scheduled Task/Job: Scheduled Task

References

  1. MSTIC. (2021, March 2). HAFNIUM targeting Exchange Servers with 0-day exploits. Retrieved March 3, 2021.
  2. Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021.
  3. Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025.
  4. Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
  1. Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022.
  2. Bromiley, M. et al. (2021, March 4). Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities. Retrieved March 9, 2021.
  3. Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022.
  4. Microsoft Threat Intelligence. (2021, December 11). Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability. Retrieved December 7, 2023.