Cataloged
IdentityTracking identifier: G0125
Reviewed identity mapping approved on this date.
HAFNIUM
Also known as Operation Exchange Marauder, Silk Typhoon
Tracked as
G0125
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
IdentityAlias: Operation Exchange Marauder
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Silk Typhoon
Reviewed identity mapping approved on this date.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
HAFNIUMCanonical Name
Operation Exchange MarauderAlias
Silk TyphoonAlias
G0125Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...