← Back to Actors
HAFNIUM
HAFNIUMOperation Exchange MarauderSilk Typhoon
[HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. [HAFNIUM](https://attack.mitre.org/groups/G0125) primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. [HAFNIUM](https://attack.mitre.org/groups/G0125) has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly oper...
45
Techniques
42
Covered
3
Gaps
93%
Coverage
Coverage42/45
COVERED (42)
T1003.001LSASS Memory111 det.T1003.003NTDS36 det.T1005Data from Local System51 det.T1016System Network Configuration Discovery41 det.T1016.001Internet Connection Discovery6 det.T1018Remote System Discovery51 det.T1033System Owner/User Discovery62 det.T1057Process Discovery23 det.T1059.001PowerShell376 det.T1059.003Windows Command Shell87 det.T1068Exploitation for Privilege Escalation102 det.T1070.001Clear Windows Event Logs16 det.T1071.001Web Protocols81 det.T1078.003Local Accounts23 det.T1078.004Cloud Accounts188 det.T1083File and Directory Discovery48 det.T1095Non-Application Layer Protocol25 det.T1098Account Manipulation245 det.T1105Ingress Tool Transfer191 det.T1110.003Password Spraying69 det.T1114.002Remote Email Collection18 det.T1119Automated Collection12 det.T1132.001Standard Encoding5 det.T1136.002Domain Account13 det.T1190Exploit Public-Facing Application233 det.T1199Trusted Relationship6 det.T1213.002Sharepoint4 det.T1218.011Rundll3276 det.T1505.003Web Shell67 det.T1530Data from Cloud Storage33 det.T1550.001Application Access Token43 det.T1555.006Cloud Secrets Management Stores8 det.T1560.001Archive via Utility27 det.T1564.001Hidden Files and Directories25 det.T1567.002Exfiltration to Cloud Storage31 det.T1583.006Web Services1 det.T1589.002Email Addresses2 det.T1590Gather Victim Network Information5 det.T1590.005IP Addresses4 det.T1592.004Client Configurations4 det.T1593.003Code Repositories2 det.T1685.005Clear Windows Event Logs12 det.