HAFNIUM

🇨🇳China-attributed

campaigns

aliases

Last seen:Mar 17, 2026

Intelligence Profile

[HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. [HAFNIUM](https://attack.mitre.org/groups/G0125) primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. [HAFNIUM](https://attack.mitre.org/groups/G0125) has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: Microsoft Silk Typhoon MAR 2025)

Threat Analysis

HAFNIUM is a known-sophistication threat actor attributed to China, engaged in cyber operations with a primary motivation of unknown activity patterns.

Known Campaigns

HAFNIUM — Active Operations March 2026

HAFNIUM is a unknown-motivation threat actor attributed to China. HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. Microsoft Threat Intelligence Center (MSTIC) attribu...

ACTIVEMEDIUM2026

External References

→https://attack.mitre.org/groups/G0125/

→https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers

→https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

→https://www.splunk.com/en_us/blog/security/detecting-hafnium-exchange-server-zero-day-activity-in-splunk.html

→https://www.reddit.com/r/msp/comments/lwmo5c/mass_exploitation_of_onprem_exchange_servers

→https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day

→https://twitter.com/ESETresearch/status/1366862946488451088

→https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html

→https://us-cert.cisa.gov/ncas/alerts/aa21-062a

→https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289

Quick Facts

TypeAPT / Threat Group

Origin🇨🇳 China

Aliases2

SourceMalpedia

Also Known As

Operation Exchange MarauderSilk Typhoon

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search HAFNIUM