Log in Request a demo

Threat group profile

HAFNIUM

Also known as Silk Typhoon, Operation Exchange Marauder

Attributed by the US and UK governments (19 July 2021) to the Chinese state, and charged by the US Department of Justice (8 July 2025) as directed by officers of China's Ministry of State Security,…

In short

Attributed by the US and UK governments (19 July 2021) to the Chinese state, and charged by the US Department of Justice (8 July 2025) as directed by officers of China's Ministry of State Security, HAFNIUM is the name given to the campaign that exploited Microsoft Exchange Server flaws in early 2021. MITRE describes it as a likely state-sponsored espionage group that targets US universities, law firms, defense contractors and research bodies.

Last updated 9 October 2026

Profile MapThreat Group
  1. Attributed OriginChina
  2. Names3names in public reportsHAFNIUM · Silk Typhoon · Operation Exchange Marauder
  3. Sectors10named as targetsUnited States · Law firms · Higher education
  4. Techniques12in the attack chainResource Development · Initial Access · Credential Access
  5. Tools8tools and malware listedChina Chopper · ASPXSpy · SIMPLESEESHARP and SPORTSBALL

In one minute

Who they are
The US Government (CISA, 19 July 2021) attributed the 2021 Exchange Server attacks to hackers affiliated with China's Ministry of State Security. The UK NCSC judged it highly likely that HAFNIUM is associated with the Chinese state (19 July 2021). The US Department of Justice charged two Chinese nationals in July 2025 and says officers of the ministry's Shanghai bureau directed them.
Who they target
MITRE lists US universities, law firms, defense contractors, policy think tanks, NGOs and infectious disease researchers. The Department of Justice names a university, a law firm and COVID-19 research among the victims.
How they usually get in
Mainly flaws in internet-facing systems. In 2021 these were flaws in on-premises Microsoft Exchange Server, followed by web shells (small scripts that give remote control of a server). MITRE also lists password spraying and stolen keys for cloud and IT vendor accounts.
What stands out
The sources describe a campaign that hit thousands of servers worldwide through one product, and they say it was run through private contractor companies. The Department of Justice says this contractor network cast a wide net, which led to more victims.
What to do first
Find every on-premises Exchange server, apply the vendor patches, and take servers that cannot be patched off the internet. Then check them for web shells and for stolen account data.

Names

Public reports use several names for this activity.

Names used for HAFNIUM
NameWhere it appears
HAFNIUM MITRE ATT&CK G0125 (group name), UK NCSC, US Department of Justice[1, 2, 8]
Silk Typhoon MITRE ATT&CK G0125 (associated group)[1]
Operation Exchange Marauder MITRE ATT&CK G0125 (associated group)[1]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK Page last modified 31 July 2026

    Describes HAFNIUM as a likely state-sponsored cyber espionage group operating out of China, active since at least January 2021.[1]

  • White House 19 July 2021

    Attributed with a high degree of confidence that malicious cyber actors affiliated with the PRC's Ministry of State Security conducted cyber espionage using the Exchange Server zero-day flaws.[5]

  • CISA 19 July 2021

    Updated advisory AA21-062A to say the US Government attributes the Exchange activity to cyber actors affiliated with the PRC Ministry of State Security.[6]

  • UK NCSC and GOV.UK 19 July 2021

    Judged it highly likely that HAFNIUM is associated with the Chinese state, and was almost certain that a Chinese state-backed actor initiated and exploited the Exchange compromise.[8, 9]

  • NATO 19 July 2021

    Acknowledged national statements by Allies such as Canada, the UK and the US attributing the Exchange compromise to the People's Republic of China.[11]

  • UK NCSC (annual review) 17 November 2021

    Said the UK joined 38 partners to attribute variously HAFNIUM, APT31 and/or APT40 to the Chinese state.[10]

  • US Department of Justice 8 July 2025

    Charged Xu Zewei and Zhang Yu and said officers of the Ministry of State Security's Shanghai State Security Bureau directed Xu to conduct the hacking.[2]

  • US Department of Justice 27 April 2026

    Said the FBI considers HAFNIUM a group responsible for a vast intrusion campaign directed by China's Ministry of State Security.[3]

  • US State Department (Rewards for Justice) Page undated

    Offers up to $10 million for information on Zhang Yu, described as working at the behest of the Ministry of State Security's Shanghai bureau.[4]

Where sources differ

Sources differ on the strength of attribution. MITRE calls HAFNIUM "likely state-sponsored". The UK NCSC says HAFNIUM is "highly likely" associated with the Chinese state. The White House (19 July 2021) says "high degree of confidence" for the Ministry of State Security. The US Department of Justice (2025) states the Shanghai bureau directed the hackers, as charges that are allegations until proven in court.

Sources differ on size. The FBI quote in the Department of Justice release of 8 July 2025 says over 60,000 US entities were targeted and more than 12,700 victimised. The NCSC cites open-source reporting of at least 30,000 organizations in the US alone. The White House says tens of thousands of computers and networks worldwide.

Sources differ on start. MITRE says active since at least January 2021. The Department of Justice says Exchange exploitation began in late 2020 and the charged intrusions run from February 2020 to June 2021.

The CISA advisory AA21-062A does not use the name HAFNIUM in its text. It attributes the Exchange activity to the Ministry of State Security.

Who they target

Sectors

  • United StatesMITRE says HAFNIUM primarily targets entities in the US. The Department of Justice says the FBI counted over 60,000 US entities targeted.[1, 2]
  • Infectious disease and COVID-19 researchMITRE lists infectious disease researchers. The Department of Justice says Xu and others targeted US universities, immunologists and virologists in early 2020.[1, 2]
  • Law firmsMITRE lists law firms. The Department of Justice names a law firm with offices worldwide among the Exchange victims and says mailboxes were searched for information on US policy makers and government agencies.[1, 2]
  • Higher educationMITRE lists higher education institutions. The Department of Justice names universities, including one in the Southern District of Texas.[1, 2]
  • Defense contractorsMITRE lists defense contractors.[1]
  • Policy think tanks and NGOsMITRE lists policy think tanks and NGOs.[1]
  • On-premises Microsoft Exchange ServerCISA says the flaws affect on-premises Exchange Servers and are not known to affect Exchange Online or Microsoft 365.[6]
  • Edge devices, remote management tools and cloud softwareMITRE says HAFNIUM has targeted remote management tools and cloud software for initial access and edge devices for exploitation.[1]
  • IT and cloud providers' customersMITRE says HAFNIUM used stolen API keys and credentials from privileged access management, cloud app and cloud data management companies to reach downstream customers.[1]
  • Exchange servers outside the USThe White House says tens of thousands of computers and networks worldwide were compromised. The NCSC says many more were affected worldwide beyond at least 30,000 in the US.[5, 9]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. Feb 2020

    COVID-19 research targeted

    The Department of Justice says Xu provided an SSSB officer with confirmation on or about 19 February 2020 that he had compromised a research university network.[2]

  2. Late 2020

    Exchange exploitation begins

    The Department of Justice says Xu and co-conspirators began exploiting Microsoft Exchange Server flaws in late 2020.[2]

  3. Jan 2021

    Start date in MITRE and CISA look-back

    MITRE says HAFNIUM has been active since at least January 2021. CISA advises checking for compromise from 1 January 2021.[1, 6]

  4. 3 Mar 2021

    CISA publishes first alert

    CISA lists 3 March 2021 as the initial version of AA21-062A on the Exchange flaws.[6]

  5. Early Mar 2021

    Flaws disclosed

    The White House says the Exchange zero-day flaws were disclosed in early March 2021. The Department of Justice says Microsoft publicly disclosed the campaign in March 2021.[5, 2]

  6. 10 Mar 2021

    FBI and CISA joint advisory

    The Department of Justice says the FBI and CISA released a joint advisory on the Exchange compromise on this date.[2]

  7. Apr 2021

    US court-authorized operation

    The Department of Justice says it announced in April 2021 an operation to remediate hundreds of US computers made vulnerable by HAFNIUM actors. CISA updated its alert on 13 April 2021.[2, 6]

  8. Jun 2021

    End of charged intrusions

    The Department of Justice says the intrusions in the indictment ran from February 2020 to June 2021.[3]

  9. 19 Jul 2021

    Allied attribution

    The US, UK and NATO issued statements on the Exchange compromise.[5, 8, 11]

  10. Aug 2021

    Tarrask in use

    MITRE says Tarrask has been used by HAFNIUM since at least August 2021.[15]

  11. 3 Jul 2025

    Xu Zewei arrested in Milan

    The Department of Justice says Xu was arrested in Italy on 3 July at the request of the United States.[2]

  12. 8 Jul 2025

    Indictment unsealed

    The Department of Justice unsealed a nine-count indictment against Xu Zewei and Zhang Yu.[2]

  13. 27 Apr 2026

    Xu extradited to the US

    The Department of Justice says Xu was extradited from Italy and appeared in court in Houston.[3]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about HAFNIUM
DateWhoWhat
10 Mar 2021 FBI and CISA Joint advisoryJoint advisory on compromise of Microsoft Exchange Server, as described by the Department of Justice.[2]
31 Mar 2021 CISA Supplemental directionSupplemental Direction v1 to Emergency Directive 21-02, which requires federal agencies to mitigate the Exchange flaws.[7]
13 Apr 2021 CISA Advisory updateUpdated alert AA21-062A with further guidance.[6]
Apr 2021 US Department of Justice Court-authorized operationOperation to remediate hundreds of US computers made vulnerable by HAFNIUM actors.[2]
19 Jul 2021 White House AttributionAttributed the Exchange cyber espionage to actors affiliated with the PRC Ministry of State Security with a high degree of confidence.[5]
19 Jul 2021 CISA Advisory updateUpdated AA21-062A with the US Government attribution.[6]
19 Jul 2021 UK Government and NCSC AttributionJudged it highly likely that HAFNIUM is associated with the Chinese state.[8, 9]
19 Jul 2021 NATO StatementAcknowledged national attributions to China and called on China to act responsibly.[11]
8 Jul 2025 US Department of Justice Indictment unsealed and arrestNine-count indictment against Xu Zewei and Zhang Yu. Xu was arrested in Italy on 3 July.[2]
27 Apr 2026 US Department of Justice ExtraditionXu Zewei extradited from Italy and appeared in court in Houston.[3]
Undated US State Department (Rewards for Justice) Reward offerUp to $10 million for information on Zhang Yu.[4]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Resource Development

  • Acquire Infrastructure: Virtual Private Server T1583.003

    Operated from leased virtual private servers in the United States.[1]

  • Compromise Infrastructure: Botnet T1584.005

    Used compromised devices in covert networks to hide communications.[1]

Initial Access

  • Exploit Public-Facing Application T1190

    Exploited multiple flaws in edge devices and on-premises Exchange Server.[1, 6]

  • Trusted Relationship T1199

    Used stolen keys and credentials from IT and cloud providers to reach their customers.[1]

  • Valid Accounts: Cloud Accounts T1078.004

    Abused service principals in compromised environments for data exfiltration.[1]

Persistence

  • Server Software Component: Web Shell T1505.003

    Deployed web shells such as China Chopper on compromised servers.[1, 6]

Credential Access

  • Brute Force: Password Spraying T1110.003

    Gained initial access through password spray attacks.[1]

  • OS Credential Dumping: LSASS Memory T1003.001

    Used procdump to dump LSASS process memory.[1]

  • OS Credential Dumping: NTDS T1003.003

    Stole copies of the Active Directory database.[1]

Collection

  • Email Collection: Remote Email Collection T1114.002

    Used web shells and MSGraph to export mailbox data.[1]

  • Archive Collected Data: Archive via Utility T1560.001

    Used 7-Zip and WinRAR to compress stolen files.[1]

Exfiltration

  • Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002

    Sent data to file sharing sites, including MEGA.[1]

Tools and malware

  • China Chopper Web shell

    MITRE lists it among the web shells HAFNIUM deployed, and CISA lists China Chopper web shells found in this activity.[1, 6]

  • ASPXSpy Web shell

    MITRE lists it among the web shells HAFNIUM deployed.[1]

  • SIMPLESEESHARP and SPORTSBALL Web shells

    MITRE lists both among the web shells HAFNIUM deployed.[1]

  • Covenant Command and control framework

    MITRE says HAFNIUM used it for command and control after compromising internet-facing servers.[13, 1]

  • PsExec Remote execution tool

    MITRE lists it among the software used by HAFNIUM.[14, 1]

  • Impacket Open-source toolkit

    MITRE lists it among the software used by HAFNIUM.[1]

  • Tarrask Malware

    MITRE says it has been used by HAFNIUM since at least August 2021 and creates hidden scheduled tasks.[15]

  • Nishang and PowerCat Downloaded tools

    MITRE says HAFNIUM downloaded tools including Nishang and PowerCat onto a compromised host.[1]

Detection and defense

  1. Patch Exchange servers fast

    CISA advises all entities to patch as soon as possible. Federal agencies with no sign of compromise must immediately apply the vendor patches.

    Counters T1190

  2. Cut exposure if you cannot patch

    Restrict external access to OWA and the Exchange Control Panel (ECP), or disconnect vulnerable Exchange servers from the internet until a patch can be applied.

    Counters T1190

  3. Run the published check script

    CISA strongly encourages running the Test-ProxyLogon.ps1 script to help find out whether servers are compromised.

    Counters T1190 T1505.003

  4. Hunt for web shells

    A web shell is a script uploaded to a compromised server for remote control. Check for unexpected files, and look back to at least 1 January 2021.

    Counters T1505.003

  5. Collect the evidence first

    Emergency Directive 21-02 tells agencies to collect system memory, web logs, Windows event logs and registry hives for triage.

    Counters T1003.001 T1505.003

  6. Assume identity compromise

    If exploitation is found, assume the network identity is compromised and follow incident response. CISA notes an attacker can reach the Active Directory database.

    Counters T1003.003 T1078.004

What Brandefense can do

  • External Attack Surface Management

    See which Exchange, remote access and edge systems face the internet so exposed or unpatched ones can be closed.

  • Cyber Threat Intelligence

    Follow government advisories and charges on HAFNIUM and match their defense steps to your own mail and edge systems.

  • Dark Web Monitoring

    Watch for leaked or sold company credentials and access offers that could be used for the password spraying and stolen-key access MITRE describes.

  • Platform

    Keep advisories, exposed assets and patch follow-up tasks for mail servers in one place.

Questions

Who is HAFNIUM?

MITRE describes it as a likely state-sponsored cyber espionage group operating out of China. The US and UK governments attributed the 2021 Exchange Server attacks to the Chinese state on 19 July 2021, and the US Department of Justice charged two Chinese nationals in July 2025.

What did HAFNIUM do in 2021?

The sources say the group exploited flaws in on-premises Microsoft Exchange Server, installed web shells and stole mailbox data. CISA lists CVE-2021-26855 and three related flaws.

Who was charged?

The US Department of Justice charged Xu Zewei and Zhang Yu in an indictment unsealed on 8 July 2025. Xu was extradited from Italy on 27 April 2026. Zhang remains at large. An indictment is an allegation.

Does Exchange Online have the same flaws?

CISA says the vulnerabilities affect on-premises Exchange Servers and are not known to affect Exchange Online or Microsoft 365.

What should I do first?

Patch on-premises Exchange servers, remove internet exposure where you cannot patch, and check for web shells and credential theft.

In our research

  1. HAFNIUM APT Group (Silk Typhoon): Exploiting the Global Attack Surface for Strategic Espionage March 2026

Sources

  1. HAFNIUM, Operation Exchange Marauder, Silk Typhoon, Group G0125 MITRE ATT&CK Supports: Group description, aliases, techniques, software, start date
  2. Justice Department Announces Arrest of Prolific Chinese State-Sponsored Contract Hacker US Department of Justice Supports: Indictment, MSS direction, victims, FBI figures, timeline
  3. Prolific Chinese State-Sponsored Contract Hacker Extradited from Italy US Department of Justice Supports: Extradition, 27 April 2026
  4. Zhang Yu (SSSB) US State Department, Rewards for Justice Supports: Reward offer for Zhang Yu
  5. The United States, Joined by Allies and Partners, Attributes Malicious Cyber Activity and Irresponsible State Behavior to the People's Republic of China The White House Supports: US attribution of 19 July 2021
  6. Mitigate Microsoft Exchange Server Vulnerabilities (AA21-062A) CISA Supports: Flaws, web shells, mitigations, US attribution update
  7. ED 21-02: Mitigate Microsoft Exchange On-Premises Product Vulnerabilities CISA Supports: Emergency directive actions for federal agencies
  8. UK and allies hold Chinese state responsible for a pervasive pattern of hacking GOV.UK Supports: UK attribution, NCSC judgement on HAFNIUM
  9. UK and allies hold Chinese state responsible for pervasive pattern of hacking UK National Cyber Security Centre Supports: NCSC assessment, US victim count, advice to organisations
  10. NCSC Annual Review 2021, Microsoft Exchange UK National Cyber Security Centre Supports: Joint attribution with 38 partners
  11. Statement by the North Atlantic Council on malicious cyber activities including the Microsoft Exchange Server compromise NATO Supports: NATO statement of 19 July 2021
  12. China Chopper, Software S0020 MITRE ATT&CK Supports: Web shell description
  13. Covenant, Software S1155 MITRE ATT&CK Supports: Command and control framework used by HAFNIUM
  14. PsExec, Software S0029 MITRE ATT&CK Supports: Remote execution tool
  15. Tarrask, Software S1011 MITRE ATT&CK Supports: Malware used since at least August 2021
  16. Exploit Public-Facing Application, T1190 MITRE ATT&CK Supports: Technique id and name
  17. Server Software Component: Web Shell, T1505.003 MITRE ATT&CK Supports: Technique id and name
  18. OS Credential Dumping: LSASS Memory, T1003.001 MITRE ATT&CK Supports: Technique id and name
  19. OS Credential Dumping: NTDS, T1003.003 MITRE ATT&CK Supports: Technique id and name
  20. Email Collection: Remote Email Collection, T1114.002 MITRE ATT&CK Supports: Technique id and name
  21. Archive Collected Data: Archive via Utility, T1560.001 MITRE ATT&CK Supports: Technique id and name
  22. Exfiltration Over Web Service: Exfiltration to Cloud Storage, T1567.002 MITRE ATT&CK Supports: Technique id and name
  23. Brute Force: Password Spraying, T1110.003 MITRE ATT&CK Supports: Technique id and name
  24. Trusted Relationship, T1199 MITRE ATT&CK Supports: Technique id and name
  25. Valid Accounts: Cloud Accounts, T1078.004 MITRE ATT&CK Supports: Technique id and name

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

Cyber espionage

Cyber espionage is the use of computer networks to secretly gather information that someone wants to keep private.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Article

APT40

APT40 (Leviathan, Gingham Typhoon) is attributed by the US, UK and six more governments to China's MSS. Targets, tactics and defences.

Read more

Technique

Exploit Public-Facing Application

Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network.

Read more