Actors/Nation-state / APT/Asia

HAFNIUM

G0125APTCN · China

AKA Silk Typhoon · DEV-0322 · Operation Exchange Marauder

CrowdStrike: JUDGMENT PANDAMITRE: G0125Secureworks: IRON TYPHOON

PRC cluster behind the 2021 Microsoft Exchange ProxyLogon mass exploitation.

Targets2

Sectors10

Threat types1

GIRs mapped0/480

Active since2017

Explore in atlas

Also tracked as

4 vendor names · 3 other aliases

Open Rosetta Stone

CrowdStrike

JUDGMENT PANDA

Microsoft

HAFNIUM

MITRE

G0125

Secureworks

IRON TYPHOON

UNATTRIBUTED ALIASESSilk TyphoonDEV-0322Operation Exchange Marauder

Victimology

Geographic footprint · 2 countries

Export STIX

origin · Chinatargeted countries · 2

ASIA · 1

United Arab Emirates

AMERICAS · 1

United States

Sectors targeted

10 of 40

Government100 actors Defense72 actors Financial Services73 actors Healthcare46 actors Technology60 actors Telecom71 actors Education & Research62 actors Legal & Professional17 actors Consulting / Professional Services34 actors Industrials / Engineering28 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 33 techniques

Reconnaissance · 3

T1589.002Email Addresses T1590Gather Victim Network Information T1592.004Client Configurations

Resource Development · 3

T1583.003Virtual Private Server T1583.005Botnet T1583.006Web Services

Initial Access · 2

T1190Exploit Public-Facing Application T1199Trusted Relationship

Execution · 2

T1059.001PowerShell T1059.003Windows Command Shell

Persistence · 1

T1098Account Manipulation

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 3

T1003.001LSASS Memory T1003.003NTDS T1555.006Cloud Secrets Management Stores

Discovery · 5

T1016System Network Configuration Discovery T1018Remote System Discovery T1033System Owner/User Discovery T1057Process Discovery T1083File and Directory Discovery

Lateral Movement · 1

T1550.001Application Access Token

Collection · 4

T1005Data from Local System T1114.002Remote Email Collection T1119Automated Collection T1560.001Archive via Utility

Exfiltration · 1

T1567.002Exfiltration to Cloud Storage

Command And Control · 3

T1071.001Web Protocols T1095Non-Application Layer Protocol T1105Ingress Tool Transfer

Stealth · 4

T1078.003Local Accounts T1078.004Cloud Accounts T1218.011Rundll32 T1564.001Hidden Files and Directories

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer33 techniques · layer format 4.5

Related actors

By origin and actor type