HAFNIUM

HAFNIUM, now more commonly tracked by Microsoft as Silk Typhoon, is a China-linked state-sponsored cyber-espionage threat actor. The group is widely associated with intelligence collection operations against government entities, policy and regulatory organizations, defense-related targets, critical infrastructure, and other strategically significant sectors. It is best known for the large-scale 2021 exploitation of Microsoft Exchange Server vulnerabilities known as ProxyLogon, which enabled rapid compromise of tens of thousands of internet-facing servers worldwide. Aliases associated with this actor include Silk Typhoon, Hafnium, Hafnium Group, Murky Panda, Operation Exchange Marauder, and Timmy. In current industry usage, Silk Typhoon is generally the preferred name, while HAFNIUM remains the most recognizable historical label because of the Exchange intrusions. The actor has demonstrated a pattern of exploiting newly disclosed and zero-day vulnerabilities in externally exposed enterprise software to obtain initial access at scale, then transitioning to targeted post-exploitation for espionage. Reported operations linked to the group include exploitation of Microsoft Exchange Server vulnerabilities such as CVE-2021-26855 and later activity involving BeyondTrust Remote Support zero-days tied to compromise of U.S. Treasury-related systems. The group has also been associated with long-term access to critical infrastructure environments. Operationally, HAFNIUM/Silk Typhoon combines vulnerability exploitation with credential and mailbox access, abuse of legitimate administrative interfaces, and selective collection from high-value accounts. Observed tradecraft includes server-side exploitation of public-facing applications, privilege escalation, PowerShell-based execution, installation of web shells or other persistence mechanisms, enumeration of high-value mailboxes, and export or collection of email data through Exchange-related services and APIs. The actor is assessed to favor stealthy follow-on access after broad initial compromise, using valid accounts and native tooling where possible. The group’s targeting and behavior are consistent with strategic Chinese intelligence requirements rather than financially motivated crime. Its operations have repeatedly focused on information of diplomatic, economic, regulatory, and national-security value, and its campaigns illustrate a broader Chinese state practice of pairing mass exploitation opportunities with selective intelligence collection.