HAFNIUM - G0125

Created: 2021-03-03T19:40:47.280Z

Modified: 2023-04-10T21:54:46.756Z

Contributors: Daniyal Naeem, BT Security,Matt Brenton, Zurich Insurance Group,Mayuresh Dani, Qualys,Harshal Tupsamudre, Qualys,Vinayak Wadhwa, SAFE Security

Aliases

HAFNIUM,Operation Exchange Marauder

Description

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)

Techniques Used

HAFNIUM has collected data and files from a compromised machine.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

HAFNIUM has hidden files on a compromised host.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

HAFNIUM has searched file contents on a compromised host.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

HAFNIUM has collected IP information via IPInfo.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

HAFNIUM has checked for network connectivity from a compromised host using

HAFNIUM has used

HAFNIUM has used

HAFNIUM has enumerated domain controllers using