hafnium

HAFNIUM, also referred to in the provided content as Silk Typhoon, Murky Panda, Operation Exchange Marauder, and Timmy, is a threat actor with a long history of attacks against defense contractors, policy think tanks, higher education, and infectious disease research institutions. The content explicitly describes HAFNIUM as having conducted an exceptionally prolific 2021 campaign exploiting multiple Microsoft Exchange Server zero-day vulnerabilities. The provided material also notes that an indictment linked Xu and Zhang to two firms previously unattributed in the public domain to the HAFNIUM/Silk Typhoon threat actor group. Behavior directly attributed in the content includes searching file contents on compromised hosts, hiding files on compromised hosts, collecting IP information via IPInfo, gathering user information with whoami, using open-source command-and-control frameworks including Covenant, and exfiltrating data from email, OneDrive, and SharePoint via MSGraph. The content also references HAFNIUM in ATT&CK-style annotations for exploitation for privilege escalation and PowerShell execution, but those references are annotation metadata rather than direct operational descriptions. Separately, Sophos stated its metasploit_gather_exchange post-exploitation module was intended to help simulate an attack like HAFNIUM’s against previously compromised Exchange servers for defensive testing.