{
  "id": "hafnium",
  "name": "HAFNIUM",
  "aliases": [
    "Operation Exchange Marauder",
    "Silk Typhoon"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Likely state-sponsored, operating from China",
      "src": [
        "mitre-g0125"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2021,
      "src": [
        "mitre-g0125"
      ],
      "conf": "medium",
      "note": "At least 2021"
    },
    {
      "k": "attack_id",
      "v": "G0125",
      "src": [
        "mitre-g0125"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.",
      "src": [
        "mitre-g0125"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 44,
      "src": [
        "mitre-g0125"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "ASPXSpy, China Chopper, Covenant, Impacket, PsExec, Tarrask",
      "src": [
        "mitre-g0125"
      ],
      "conf": "high",
      "note": "6 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0125)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/hafnium.html",
  "sources": {
    "mitre-g0125": {
      "title": "HAFNIUM, Group G0125",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0125/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}