HAFNIUM
IntrusionSet · ATTACK:enterprise:G0125
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0125",
"title": "HAFNIUM",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0125",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--2688b13e-8e71-405a-9c40-0dee94bddf87",
"external_id": "G0125",
"domain": "enterprise",
"created": "2021-03-03T19:40:47.280Z",
"modified": "2026-07-31T18:47:43.478Z",
"version": "3.0",
"aliases": [
"HAFNIUM",
"Operation Exchange Marauder",
"Silk Typhoon"
],
"tactics": [
],
"source_references": [
{
"source_name": "Silk Typhoon"
},
{
"source_name": "Operation Exchange Marauder"
},
{
"source_name": "Volexity Exchange Marauder March 2021",
"url": "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Silk Typhoon MAR 2025",
"url": "https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"
},
{
"source_name": "Microsoft HAFNIUM March 2020",
"url": "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
}
]
}Explicit source assertions (50)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1592.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02c3ea88-c33c-47d8-a34a-532ed5498a3d
Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1110.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0502f3b2-8ec0-444e-830f-d77e703544a8
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05ff481d-299f-4b72-9210-f07e7c5bf938
Rapid7 HAFNIUM Mar 2021 · Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:S1011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--067696dc-a106-42d7-9fc9-31c4865879e8
Tarrask scheduled taskATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1583.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--079eaba3-fdea-4551-b126-6e824136e6f5
Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b7dfe49-d8c3-46d8-84ed-bf1898638ac3
Microsoft HAFNIUM March 2020 · Volexity Exchange Marauder March 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12cfc154-5240-47ce-ba54-ec40f8a6d13d
Rapid7 HAFNIUM Mar 2021 · Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1583.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16b574c0-8e09-44ae-b4d2-b79e8bbd576a
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ffb7c73-5c51-48a3-85a0-b64111cccdd1
Rapid7 HAFNIUM Mar 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24f5e8ad-02e9-43d5-9f82-cd9cc1b7a7b6
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b28f78f-fc26-44cb-bf06-fb437252d97e
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1584.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30719028-6cad-4bc2-a97e-7012eeee5bbf
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f7c9ed8-62c0-44fe-9eb1-68b3c226e598
Rapid7 HAFNIUM Mar 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:S0073
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41561c6a-7749-4607-a8d1-c094631b4aaa
Volexity Exchange Marauder March 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--465d0043-32d0-4ec9-84a6-c0f455f9a33b
Rapid7 HAFNIUM Mar 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--467d9812-8d19-4fca-a2fd-5a8e1dbb43f7
Rapid7 HAFNIUM Mar 2021 · Volexity Exchange Marauder March 2021 · Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fd56621-eb11-43b9-b90f-e6739af43660
Tarrask scheduled taskATTACK:enterprise:G0125 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--577f5fe4-3fb4-4969-a5a4-5b7c1bc693a8
Volexity Exchange Marauder March 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1530
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5afc74e6-789b-4402-89d2-cc7be1994cf5
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e1a2fcd-bb4e-43b2-8f42-33fb5bf80b21
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:S1155
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f917518-2f54-479e-a008-cbf6bd6037c0
Microsoft Silk Typhoon MAR 2025 · Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73e8d90b-62e2-4ea2-b66c-2c94297bdcc5
Volexity Exchange Marauder March 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1505.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--746c3746-a4e3-4fcb-849c-a1646e48a1bf
FireEye Exchange Zero Days March 2021 · Rapid7 HAFNIUM Mar 2021 · Volexity Exchange Marauder March 2021 · Microsoft Silk Typhoon MAR 2025 · Tarrask scheduled task · Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76bef74f-4820-4838-b56e-b59ae71ac170
Volexity Exchange Marauder March 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1555.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78682fae-51e0-4397-b8ab-3348ad5609c2
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1593.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ce696b0-6d76-4f54-ae4f-4e7115255a5d
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80efda4a-36a7-4b59-9f70-72f4952e2140
Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1114.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--885c54ee-078a-4cc2-a2a1-c7376767b6b6
Volexity Exchange Marauder March 2021 · Microsoft Silk Typhoon MAR 2025 · Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94a67c86-e7f6-4874-b41f-83a3bfc35be3
Volexity Exchange Marauder March 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:S0020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--951774ce-173c-4aaf-a6e3-515ba497d523
FireEye Exchange Zero Days March 2021 · Rapid7 HAFNIUM Mar 2021 · Volexity Exchange Marauder March 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1078.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--996765a6-6c8a-429d-baa5-32d423fb4207
FireEye Exchange Zero Days March 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1625ff1-af65-4dbb-b192-3c462fae1acf
Microsoft HAFNIUM March 2020 · Volexity Exchange Marauder March 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab6a59bc-fa67-4d6f-ab55-e5cb35f62839
Rapid7 HAFNIUM Mar 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--baaa6228-daa9-45e9-884e-42add3851843
Rapid7 HAFNIUM Mar 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be93a442-915b-4923-b7dd-0a20098fe264
Rapid7 HAFNIUM Mar 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1590.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8a0a286-1296-4f87-bc6e-322cd956fb73
Volexity Exchange Marauder March 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1199
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca446484-9d2d-464d-bb17-88914d6f9b36
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc12f7b7-05a6-4078-b9b5-411e2a2836ba
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf249a85-b0e9-4264-899f-164cdfa5a7c8
Rapid7 HAFNIUM Mar 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1197689-ff2e-4a0e-ad1e-69bb14c8822d
Volexity Exchange Marauder March 2021 · Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1098
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2edfaee-154b-4566-b85c-740e591477d9
Volexity Exchange Marauder March 2021 · Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1136.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d814a304-f957-4e7c-9890-30a6d5be39bd
Volexity Exchange Marauder March 2021 · Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dca36cf3-4501-4682-9d3e-df148b46792e
Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de7f9b12-d6e7-4ef6-b55c-77bbca0f8c83
Rapid7 HAFNIUM Mar 2021ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1550.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4f78cff-0b68-42b0-9fa7-ffc493a67980
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5c8f8fd-2231-4d95-be4d-3757a4592907
Microsoft Silk Typhoon MAR 2025ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8e6f472-e048-401c-8a2e-5e2effc09040
FireEye Exchange Zero Days March 2021 · Volexity Exchange Marauder March 2021 · Microsoft Silk Typhoon MAR 2025 · Tarrask scheduled task · Microsoft Log4j Vulnerability Exploitation December 2021 · Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f503c254-b86c-433e-8107-585c53f23b6e
Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8fe4311-f367-42bb-a51d-688753d0218b
Microsoft HAFNIUM March 2020ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1583.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fedcb717-2453-4c77-8f05-8a28f934725e
Microsoft HAFNIUM March 2020