HAFNIUM

Names and who uses them

• HAFNIUMOur name
• Silk TyphoonMicrosoft
• Operation Exchange MarauderVolexity

Targets

Sectors: Defence, Education, Legal, NGOs and think tanks

Regions: United States

Known techniques

• T1003.001LSASS Memory
• T1003.003NTDS
• T1005Data from Local System
• T1016System Network Configuration Discovery
• T1016.001Internet Connection Discovery
• T1018Remote System Discovery
• T1033System Owner/User Discovery
• T1057Process Discovery
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1068Exploitation for Privilege Escalation
• T1071.001Web Protocols
• T1078.003Local Accounts
• T1078.004Cloud Accounts
• T1083File and Directory Discovery
• T1095Non-Application Layer Protocol
• T1098Account Manipulation
• T1105Ingress Tool Transfer
• T1110.003Password Spraying
• T1114.002Remote Email Collection
• T1119Automated Collection
• T1132.001Standard Encoding
• T1136.002Domain Account
• T1190Exploit Public-Facing Application
• T1199Trusted Relationship
• T1213.002Sharepoint
• T1218.011Rundll32
• T1505.003Web Shell
• T1530Data from Cloud Storage
• T1550.001Application Access Token
• T1555.006Cloud Secrets Management Stores
• T1560.001Archive via Utility
• T1564.001Hidden Files and Directories
• T1567.002Exfiltration to Cloud Storage
• T1583.003Virtual Private Server
• T1583.005Botnet
• T1583.006Web Services
• T1584.005Botnet
• T1589.002Email Addresses
• T1590Gather Victim Network Information

Malware and tools used