HAFNIUM

Overview

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.

Naming & attribution

HAFNIUM is tracked under 3 names across the industry. It uses 44 documented ATT&CK techniques — more than 79% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1592.004 Client Configurations — used by 1 of 174 groups
• T1550.001 Application Access Token — used by 2 of 174 groups
• T1555.006 Cloud Secrets Management Stores — used by 2 of 174 groups
• T1583.005 Botnet — used by 3 of 174 groups
• T1590 Gather Victim Network Information — used by 3 of 174 groups
• T1590.005 IP Addresses — used by 3 of 174 groups
• T1593.003 Code Repositories — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Ke3chang China — 18 shared techniques (25% overlap)
• APT28 Russia — 25 shared techniques (22% overlap)
• Play — 12 shared techniques (21% overlap)
• Magic Hound Iran — 20 shared techniques (20% overlap)
• Chimera China — 17 shared techniques (20% overlap)
• Volt Typhoon China — 20 shared techniques (19% overlap)

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190
• Custom malware/implant development — ATT&CK: 3 attributed custom malware families

TTPs — 44 techniques across 14 tactics

Tools & malware (6)

Tarrask · ASPXSpy · Impacket · PsExec · Covenant · China Chopper

Reporting (3)

• Silk Typhoon targeting IT supply chain — Microsoft Threat Intelligence
• How Microsoft names threat actors — Microsoft
• Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities — Gruzweig, J. et al