HAFNIUM has created domain accounts.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|PRE|T1590|Gather Victim Network Information|

HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.003|NTDS|

HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

HAFNIUM has collected e-mail addresses for users they intended to target.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

HAFNIUM has used the Exchange Power Shell module

HAFNIUM has used web shells to export mailbox data.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

HAFNIUM has used

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL,

China Chopper, and