HAFNIUM

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: Operation Exchange Marauder, Silk Typhoon

CyberCHN

Identification silhouette. Not drawn to scale between entries.

Fact cardConfidence · Source

System

TypeSuspected state-linked cyber threat group

Alternative designationsOperation Exchange Marauder, Silk Typhoon

ProliferationOrigin country only

Active since2021At least 2021Med^[1]

MITRE ATT&CK IDG0125High^[1]

Capabilities

ATT&CK techniques used44ATT&CK v20.1High^[1]

Malware and toolsASPXSpy, China Chopper, Covenant, Impacket, PsExec, Tarrask6 malware and tool entries linked in ATT&CKHigh^[1]

Attribution and activity

Attributed sponsorLikely state-sponsored, operating from ChinaMed^[1]

TargetsHAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.Med^[1]

Notes

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.

Summary

Draft entry. Values come from the cited public sources and are awaiting editor verification.

Compare JSON

Operators

China

Sources

HAFNIUM, Group G0125, MITRE ATT&CK
Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08

Change log

2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0125)