Loading IOCs…

{'aliases': ['HAFNIUM', 'Operation Exchange Marauder', 'Silk Typhoon'],
 'created': '2021-03-03T19:40:47.280Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely '
                'state-sponsored cyber espionage group operating out of China '
                'that has been active since at least January 2021. '
                '[HAFNIUM](https://attack.mitre.org/groups/G0125) primarily '
                'targets entities in the US across a number of industry '
                'sectors, including infectious disease researchers, law firms, '
                'higher education institutions, defense contractors, policy '
                'think tanks, and NGOs. '
                '[HAFNIUM](https://attack.mitre.org/groups/G0125) has targeted '
                'remote management tools and cloud software for intial access '
                'and has demonstrated an ability to quickly operationalize '
                'exploits for identified vulnerabilities in edge '
                'devices.(Citation: Microsoft HAFNIUM March 2020)(Citation: '
                'Volexity Exchange Marauder March 2021)(Citation: Microsoft '
                'Silk Typhoon MAR 2025)',
 'external_references': [{'external_id': 'G0125',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0125'},
                         {'description': '(Citation: Microsoft Threat Actor '
                                         'Naming July 2023)(Citation: '
                                         'Microsoft Silk Typhoon MAR 2025)',
                          'source_name': 'Silk Typhoon'},
                         {'description': '(Citation: Volexity Exchange '
                                         'Marauder March 2021)',
                          'source_name': 'Operation Exchange Marauder'},
                         {'description': 'Gruzweig, J. et al. (2021, March 2). '
                                         'Operation Exchange Marauder: Active '
                                         'Exploitation of Multiple Zero-Day '
                                         'Microsoft Exchange Vulnerabilities. '
                                         'Retrieved March 3, 2021.',
                          'source_name': 'Volexity Exchange Marauder March '
                                         '2021',
                          'url': 'https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/'},
                         {'description': 'Microsoft . (2023, July 12). How '
                                         'Microsoft names threat actors. '
                                         'Retrieved November 17, 2023.',
                          'source_name': 'Microsoft Threat Actor Naming July '
                                         '2023',
                          'url': 'https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide'},
                         {'description': 'Microsoft Threat Intelligence . '
                                         '(2025, March 5). Silk Typhoon '
                                         'targeting IT supply chain. Retrieved '
                                         'March 20, 2025.',
                          'source_name': 'Microsoft Silk Typhoon MAR 2025',
                          'url': 'https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/'},
                         {'description': 'MSTIC. (2021, March 2). HAFNIUM '
                                         'targeting Exchange Servers with '
                                         '0-day exploits. Retrieved March 3, '
                                         '2021.',
                          'source_name': 'Microsoft HAFNIUM March 2020',
                          'url': 'https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'}],
 'id': 'intrusion-set--2688b13e-8e71-405a-9c40-0dee94bddf87',
 'modified': '2025-03-25T18:04:13.368Z',
 'name': 'HAFNIUM',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Daniyal Naeem, BT Security',
                          'Matt Brenton, Zurich Insurance Group',
                          'Mayuresh Dani, Qualys',
                          'Harshal Tupsamudre, Qualys',
                          'Vinayak Wadhwa, SAFE Security'],
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '3.0'}