HAFNIUM — APT Profile

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.

Also tracked as

Operation Exchange Marauder, Silk Typhoon

Tools & malware

ASPXSpy Web Shell
China Chopper Web Shell
Covenant Post-Exploitation Framework
Impacket Network Toolkit
PsExec Remote Execution
Tarrask Backdoor

Vendor research

How Microsoft names threat actors Microsoft
Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities Volexity
Silk Typhoon targeting IT supply chain Microsoft
HAFNIUM targeting Exchange Servers with 0-day exploits Microsoft

Read the full analysis on IntelFusions