← Back to Actors
HAFNIUM
HAFNIUMOperation Exchange MarauderSilk Typhoon
[HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. [HAFNIUM](https://attack.mitre.org/groups/G0125) primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. [HAFNIUM](https://attack.mitre.org/groups/G0125) has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly oper...
45
Techniques
42
Covered
3
Gaps
93%
Coverage
Coverage42/45
COVERED (42)
T1003.001LSASS Memory111 det.T1003.003NTDS36 det.T1005Data from Local System51 det.T1016System Network Configuration Discovery41 det.T1016.001Internet Connection Discovery6 det.T1018Remote System Discovery52 det.T1033System Owner/User Discovery62 det.T1057Process Discovery24 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1068Exploitation for Privilege Escalation104 det.T1070.001Clear Windows Event Logs16 det.T1071.001Web Protocols83 det.T1078.003Local Accounts24 det.T1078.004Cloud Accounts200 det.T1083File and Directory Discovery49 det.T1095Non-Application Layer Protocol26 det.T1098Account Manipulation258 det.T1105Ingress Tool Transfer199 det.T1110.003Password Spraying73 det.T1114.002Remote Email Collection18 det.T1119Automated Collection12 det.T1132.001Standard Encoding5 det.T1136.002Domain Account13 det.T1190Exploit Public-Facing Application240 det.T1199Trusted Relationship6 det.T1213.002Sharepoint4 det.T1218.011Rundll3278 det.T1505.003Web Shell70 det.T1530Data from Cloud Storage39 det.T1550.001Application Access Token45 det.T1555.006Cloud Secrets Management Stores10 det.T1560.001Archive via Utility27 det.T1564.001Hidden Files and Directories26 det.T1567.002Exfiltration to Cloud Storage33 det.T1583.006Web Services1 det.T1589.002Email Addresses2 det.T1590Gather Victim Network Information5 det.T1590.005IP Addresses4 det.T1592.004Client Configurations4 det.T1593.003Code Repositories2 det.T1685.005Clear Windows Event Logs12 det.