HAFNIUM
Nation-state Espionage China Dormant
Aliases: Silk Typhoon
Also seen as: Hafnium
- Mentions
- 5
- First seen
- 03 Nov 2021
- Last seen
- 07 Oct 2026
Relevant to you · Affects your stack
- Technology:
- Microsoft Windows Server 2022Microsoft Remote Desktop Gateway
- Threat focus:
- espionage / aptindustrial / ot espionage
- Sector / region:
- Manufacturing
Origin
China — Chinese state-linked
Profile
HAFNIUM is a Chinese threat actor, with the US offering a $10 million reward for an accused hacker. The reporting mentions several remote code execution vulnerabilities in Microsoft Exchange Server, including CVE-2022-41082, CVE-2021-26858, CVE-2021-27065, and CVE-2021-26857. These vulnerabilities are associated with HAFNIUM, although the headlines do not specify targets or malware.
Affected vendors
Microsoft
How they operate (MITRE tactics)
Initial Access
Persistence
Lateral Movement
Recommended mitigations
Derived from MITRE ATT&CK, mapped to this actor's techniques.
- M1016 Vulnerability Scanning
- M1018 User Account Management
- M1019 Threat Intelligence Program
- M1021 Restrict Web-Based Content
- M1026 Privileged Account Management
- M1030 Network Segmentation
- M1033 Limit Software Installation
- M1035 Limit Access to Resource Over Network
- M1037 Filter Network Traffic
- M1038 Execution Prevention
- M1040 Behavior Prevention on Endpoint
- M1042 Disable or Remove Feature or Program
- M1045 Code Signing
- M1047 Audit
- M1048 Application Isolation and Sandboxing
- M1049 Antivirus/Antimalware
- M1050 Exploit Protection
- M1051 Update Software
Linked CVEs
- CVE-2022-41082 KEV CVSS 8.0 EPSS 91%
- CVE-2021-27065 KEV CVSS 7.8 EPSS 94%
- CVE-2021-26858 KEV CVSS 7.8 EPSS 74%
- CVE-2021-26857 KEV CVSS 7.8 EPSS 45%
Related actors
Share a CVE, technique or malware with this actor.
Activity (8 weeks)
Recent activity
- US posts $10 million reward for accused Chinese ‘Hafnium’ hacker The Record from Recorded Future News
- CVE-2022-41082 — Microsoft Exchange Server Remote Code Execution Vulnerability CISA KEV
- CVE-2021-26858 — Microsoft Exchange Server Remote Code Execution Vulnerability CISA KEV
- CVE-2021-27065 — Microsoft Exchange Server Remote Code Execution Vulnerability CISA KEV
- CVE-2021-26857 — Microsoft Exchange Server Remote Code Execution Vulnerability CISA KEV