Trusted Design

HAFNIUM

アクターID: G0125

· MITRE Pageへのリンク

脅威アクターの詳細

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: Microsoft Silk Typhoon MAR 2025)

脅威アクターの別名・別称

HAFNIUM
Operation Exchange Marauder
Silk Typhoon

利用した攻撃手法

• T1560.001 - Archive via Utility
• T1557 - Adversary-in-the-Middle
• T1583 - Acquire Infrastructure
• T1161 - LC_LOAD_DYLIB Addition
• T1574.007 - Path Interception by PATH Environment Variable
• T1171 - LLMNR/NBT-NS Poisoning and Relay
• T1099 - Timestomp
• T1487 - Disk Structure Wipe
• T1027.008 - Stripped Payloads
• T1553.001 - Gatekeeper Bypass
• T1584.003 - Virtual Private Server
• T1140 - Deobfuscate/Decode Files or Information
• T1555.003 - Credentials from Web Browsers
• T1547.003 - Time Providers
• T1546.005 - Trap
• T1027.016 - Junk Code Insertion
• T1134.002 - Create Process with Token
• T1590.006 - Network Security Appliances
• T1218.008 - Odbcconf
• T1593.003 - Code Repositories
• T1059 - Command and Scripting Interpreter
• T1175 - Component Object Model and Distributed COM
• T1219.001 - IDE Tunneling
• T1049 - System Network Connections Discovery
• T1608.005 - Link Target
• T1583.006 - Web Services
• T1497.002 - User Activity Based Checks
• T1552.008 - Chat Messages
• T1122 - Component Object Model Hijacking
• T1210 - Exploitation of Remote Services
• T1039 - Data from Network Shared Drive
• T1204.003 - Malicious Image
• T1056 - Input Capture
• T1203 - Exploitation for Client Execution
• T1518.001 - Security Software Discovery
• T1591.004 - Identify Roles
• T1556.005 - Reversible Encryption
• T1134 - Access Token Manipulation
• T1547.013 - XDG Autostart Entries
• T1105 - Ingress Tool Transfer
• T1548.006 - TCC Manipulation
• T1055.008 - Ptrace System Calls
• T1021.001 - Remote Desktop Protocol
• T1490 - Inhibit System Recovery

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1039)
• CVE-2015-5749 (T1560.001)
• CVE-2016-1898 (T1203)
• CVE-2016-1897 (T1203)
• CVE-2015-7261 (T1140)
• CVE-2015-6036 (T1027.008)
• CVE-2015-7262 (T1039)
• CVE-2015-0932 (T1140)
• CVE-2010-3081 (T1039)
• CVE-2017-16929 (T1219.001)
• CVE-2025-31125 (T1219.001)
• CVE-2025-68645 (T1219.001)
• CVE-2013-6282 (T1219.001)
• CVE-2014-4114 (T1497.002)
• CVE-2012-1856 (T1548.006)
• CVE-2014-6332 (T1049)
• CVE-2012-0158 (T1548.006)
• CVE-2015-1701 (T1039)
• CVE-2012-4969 (T1591.004)
• CVE-2014-1776 (T1219.001)
• CVE-2013-3660 (T1039)
• CVE-2010-0806 (T1547.013)
• CVE-2015-2360 (T1039)
• CVE-2010-4398 (T1039)
• CVE-2014-1761 (T1049)
• CVE-2015-1641 (T1049)
• CVE-2015-5119 (T1039)
• CVE-2015-5122 (T1134)
• CVE-2015-1427 (T1555.003)
• CVE-2015-1770 (T1497.002)
• CVE-2015-2545 (T1049)
• CVE-2015-2546 (T1039)
• CVE-2015-3785 (T1219.001)
• CVE-2015-7645 (T1039)
• CVE-2017-0199 (T1497.002)
• CVE-2017-12149 (T1027.008)
• CVE-2015-3043 (T1134)
• CVE-2015-3456 (T1590.006)
• CVE-2015-3090 (T1039)
• CVE-2010-1553 (T1039)
• CVE-2015-3113 (T1039)
• CVE-2015-2590 (T1039)
• CVE-2015-2424 (T1049)
• CVE-2015-0097 (T1049)
• CVE-2015-2502 (T1039)
• CVE-2014-6271 (T1591.004)
• CVE-2013-2094 (T1039)
• CVE-2014-4113 (T1039)
• CVE-2015-8562 (T1203)
• CVE-2015-7808 (T1203)
• CVE-2012-1889 (T1027.008)
• CVE-2016-1990 (T1039)
• CVE-2016-1991 (T1203)
• CVE-2016-1010 (T1039)
• CVE-2016-1019 (T1219.001)
• CVE-2016-0984 (T1039)
• CVE-2016-1001 (T1219.001)
• CVE-2016-0998 (T1039)
• CVE-2015-0313 (T1039)
• CVE-2015-0359 (T1134)
• CVE-2014-0329 (T1219.001)
• CVE-2015-5130 (T1039)
• CVE-2015-5134 (T1039)
• CVE-2015-5539 (T1039)
• CVE-2015-5557 (T1039)
• CVE-2015-5563 (T1039)
• CVE-2015-5559 (T1039)
• CVE-2015-5540 (T1039)
• CVE-2015-5561 (T1039)
• CVE-2015-5551 (T1039)
• CVE-2015-5564 (T1039)
• CVE-2015-5565 (T1039)
• CVE-2015-5550 (T1039)
• CVE-2015-5566 (T1039)
• CVE-2015-5127 (T1039)
• CVE-2015-5556 (T1039)
• CVE-2015-3628 (T1039)
• CVE-2015-6034 (T1039)
• CVE-2015-2852 (T1219.001)
• CVE-2015-2854 (T1203)
• CVE-2015-7755 (T1608.005)
• CVE-2016-1287 (T1039)
• CVE-2015-6585 (T1175)
• CVE-2015-6022 (T1219.001)
• CVE-2015-8287 (T1590.006)
• CVE-2016-1562 (T1027.008)
• CVE-2016-2342 (T1608.005)
• CVE-2016-2343 (T1027.008)
• CVE-2017-0263 (T1039)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2016-6532 (T1546.005)
• CVE-2016-9494 (T1039)
• CVE-2016-9496 (T1027.008)
• CVE-2017-3212 (T1027.008)
• CVE-2025-55182 (T1219.001)
• CVE-2015-0311 (T1039)
• CVE-2013-3906 (T1049)
• CVE-2014-6352 (T1497.002)
• CVE-2015-0016 (T1039)
• CVE-2010-3333 (T1049)
• CVE-2012-3213 (T1219.001)
• CVE-2012-4792 (T1547.013)
• CVE-2014-0322 (T1219.001)
• CVE-2012-1258 (T1039)
• CVE-2015-0336 (T1039)
• CVE-2011-3544 (T1219.001)
• CVE-2014-3153 (T1039)
• CVE-2014-7911 (T1027.008)
• CVE-2014-4322 (T1039)
• CVE-2015-3636 (T1039)
• CVE-2015-3105 (T1219.001)
• CVE-2014-0497 (T1219.001)
• CVE-2014-8361 (T1556.005)
• CVE-2017-17215 (T1219.001)
• CVE-2013-0074 (T1608.005)
• CVE-2012-0507 (T1219.001)
• CVE-2013-2465 (T1219.001)
• CVE-2014-8439 (T1219.001)
• CVE-2013-2551 (T1608.005)
• CVE-2010-0188 (T1591.004)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1219.001)
• CVE-2015-0310 (T1039)
• CVE-2012-4681 (T1039)
• CVE-2014-0556 (T1219.001)
• CVE-2012-1876 (T1608.005)
• CVE-2015-5560 (T1219.001)
• CVE-2015-0057 (T1039)
• CVE-2012-2539 (T1049)
• CVE-2014-9163 (T1219.001)
• CVE-2012-1723 (T1219.001)
• CVE-2015-1761 (T1039)
• CVE-2014-8440 (T1134)
• CVE-2010-1297 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2013-7331 (T1548.006)
• CVE-2014-4148 (T1049)
• CVE-2011-3402 (T1049)
• CVE-2014-6324 (T1039)
• CVE-2010-2883 (T1591.004)
• CVE-2013-0634 (T1140)
• CVE-2014-7247 (T1049)
• CVE-2012-5054 (T1027.008)
• CVE-2013-2678 (T1049)
• CVE-2015-2426 (T1049)
• CVE-2008-1436 (T1490)
• CVE-2010-0232 (T1039)
• CVE-2013-0641 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2014-3393 (T1219.001)
• CVE-2013-2595 (T1039)
• CVE-2014-2273 (T1219.001)
• CVE-2015-4902 (T1219.001)
• CVE-2014-3897 (T1219.001)
• CVE-2015-2387 (T1039)
• CVE-2009-3129 (T1049)
• CVE-2010-2572 (T1049)
• CVE-2011-1255 (T1548.006)
• CVE-2011-0611 (T1591.004)
• CVE-2013-5990 (T1049)
• CVE-2017-8570 (T1219.001)
• CVE-2012-0611 (T1039)
• CVE-2015-2419 (T1219.001)
• CVE-2016-0189 (T1219.001)
• CVE-2016-4117 (T1219.001)
• CVE-2017-0001 (T1039)
• CVE-2017-0143 (T1049)
• CVE-2023-1389 (T1134)
• CVE-2025-13335 (T1027.008)
• CVE-2025-13927 (T1027.008)
• CVE-2025-13928 (T1027.008)
• CVE-2025-24893 (T1219.001)
• CVE-2025-34026 (T1219.001)
• CVE-2025-54313 (T1027.008)
• CVE-2025-55183 (T1219.001)
• CVE-2025-55184 (T1219.001)
• CVE-2025-66478 (T1219.001)
• CVE-2026-0723 (T1219.001)
• CVE-2026-1102 (T1027.008)
• CVE-2026-20127 (T1039)
• CVE-2015-8286 (T1140)
• CVE-2012-0056 (T1039)
• CVE-2015-5897 (T1039)
• CVE-2015-2853 (T1219.001)
• CVE-2015-0071 (T1608.005)
• CVE-2012-6422 (T1039)
• CVE-2017-7255 (T1134)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る