Actors/Nation-state / APT/Asia

HAFNIUM

G0125APTCN · China

AKA Silk Typhoon · DEV-0322 · Operation Exchange Marauder

CrowdStrike: JUDGMENT PANDAMandiant: UNC3944MITRE: G0125Secureworks: IRON TYPHOON

PRC cluster behind the 2021 Microsoft Exchange ProxyLogon mass exploitation.

Targets2

Sectors10

Threat types1

GIRs covered0/480

Active since2017

Also tracked as

5 vendor names · 3 other aliases

Open Rosetta Stone

CrowdStrike

JUDGMENT PANDA

Mandiant

UNC3944

Microsoft

HAFNIUM

MITRE

G0125

Secureworks

IRON TYPHOON

UNATTRIBUTED ALIASESSilk TyphoonDEV-0322Operation Exchange Marauder

Victimology

Geographic footprint · 2 countries

origin · Chinatargeted countries · 2

ASIA · 1

United Arab Emirates

AMERICAS · 1

United States

Sectors targeted

10 of 40

Government100 actors Defense72 actors Financial Services74 actors Healthcare47 actors Technology60 actors Telecom72 actors Education & Research62 actors Legal & Professional18 actors Consulting / Professional Services35 actors Industrials / Engineering29 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 33 techniques

Reconnaissance · 3

T1589.002Email Addresses T1590Gather Victim Network Information T1592.004Client Configurations

Resource Development · 3

T1583.003Virtual Private Server T1583.005Botnet

Initial Access · 2

T1190Exploit Public-Facing Application

Execution · 2

T1059.001PowerShell T1059.003

Persistence · 1

T1098Account Manipulation

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 3

T1003.001LSASS Memory

Discovery · 5

T1016System Network Configuration Discovery

Lateral Movement · 1

Collection · 4

T1005Data from Local System T1114.002Remote Email Collection T1119Automated Collection

Exfiltration · 1

T1567.002Exfiltration to Cloud Storage

Command And Control · 3

T1071.001Web Protocols T1095Non-Application Layer Protocol

Stealth · 4

T1078.003Local Accounts

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer33 techniques · layer format 4.5

Related actors

By origin and actor type

T1583.006

Web Services

T1199

Trusted Relationship

Windows Command Shell

T1003.003

NTDS

T1555.006Cloud Secrets Management Stores

T1018

Remote System Discovery

T1033System Owner/User Discovery

T1057Process Discovery

T1083File and Directory Discovery

T1550.001

Application Access Token

T1560.001

Archive via Utility

T1105

Ingress Tool Transfer

T1078.004

Cloud Accounts

T1218.011Rundll32

T1564.001Hidden Files and Directories