G0125 HAFNIUM
Enterprisealso known asHAFNIUM · Operation Exchange Marauder · Silk Typhoon
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.
canonical actor
The group this is attributed to.
techniques used (44)
ATT&CK techniques this enables or maps to.
software used (6)
Malware and tools associated with this.
Detected by (Sigma) (2)
Sigma detection rules related to this.
source
Where this definition is published.