HAFNIUM

At a glance

Facts

• HAFNIUM is a group assessed to be state-sponsored and operating out of China

Activity timeline

Facts

• Conducted intrusions targeting U.S. universities and scientists working on COVID-19 vaccines, treatment, and testing in early 2020
• Exploited flaws in Microsoft Exchange Server from late 2020 in the campaign later called HAFNIUM
• The HAFNIUM campaign as a whole compromised more than 12,700 U.S. organizations
• Alleged hacking took place between February 2020 and June 2021

Attribution assessment

Facts

• Microsoft tracks HAFNIUM as Silk Typhoon
• The campaign is assessed to be state-sponsored and operating out of China
• Hackers linked to the Chinese Ministry of State Security (MSS) carried out the HAFNIUM campaign according to the United States and partner governments

Initial access and identity targets

Facts

• Exploited four zero-day flaws in Microsoft Exchange Server, including ProxyLogon

Capabilities and evasion

Facts

• Ability to exploit zero-day vulnerabilities in Microsoft Exchange Server

Infrastructure patterns

Facts

• Zhang Yu worked at Shanghai Firetech Information Science and Technology
• Xu Zewei allegedly worked for Shanghai Powerock Network
• China uses private companies and contractors to hide its role in cyber operations

Observed targeting

Facts

• Targeted U.S. universities and scientists working on COVID-19 research
• Targeted U.S. critical infrastructure
• Compromised networks of two Texas universities and an international law firm with an office in Washington, D.C.

Named victims

Organizations

• two Texas universities
• an international law firm with an office in Washington, D.C.

Reported detail

Facts

• HAFNIUM, a Chinese state-sponsored group also tracked as Silk Typhoon, conducted Exchange Server attacks between 2020 and 2021 that compromised over 12,700 U.S. organizations.
• Zhang Yu, described as a director at Shanghai Firetech, and Xu Zewei allegedly coordinated the campaign under direction from the Shanghai State Security Bureau, a branch of China's MSS.
• The group targeted U.S. universities researching COVID-19 and exploited Microsoft Exchange Server zero-day vulnerabilities including ProxyLogon.
• Xu Zewei was arrested in Milan in July 2025 and extradited to the United States in April 2026; Zhang Yu remains at large.
• The U.S. is offering $10 million for information on Zhang Yu's whereabouts or identification.