- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, Ministry of State Security
- Motivation
- Information theft and espionage
- Seen
- 2021–2026
- Status
- Active
- ATT&CK
- G0125 · 44 techniques
- Sources
- 13 sources carry it
- Identifier
- GINC-APT-0015 · hafnium
ChinaWhat it is
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Murky Panda
- Mandiant
- UNC2639, UNC2640, UNC2643
- Microsoft
- Silk Typhoon
- MITRE ATT&CK
- G0125
- PwC
- Red Dev 13
- Thales
- ATK233
- Operations
- Operation Exchange Marauder
- Other names
- timmy
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Tools
The tools and malware families the sources tie to it.
- 4 MS Exchange 0-days
- 7-Zip
- ASPXSpy
- Archelaus Beta
- China Chopper
- Covenant
- CrossRat
- Impacket
- Mega
- Nishang
- PowerCat
- Procdump
- PsExec
- Tarrask
- UNITEDRAKE
- Xploit
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de