G0125: HAFNIUM
MITRE ATT&CK G0125: HAFNIUM Group details, with detection guidance, relationships and mapped CVEs.
Security context for executives and security teams
HAFNIUM matters because ATT&CK describes it as a likely state-sponsored espionage group that has targeted U.S. organizations and has used remote management tools, cloud software, and rapidly operationalized exploits against edge devices for initial access. For leaders, the practical issue is not the name alone; it is whether the organization can quickly identify exposed edge, email, cloud, identity, and remote administration surfaces, prove patch and hardening status, and investigate web shell, credential theft, account abuse, and lateral movement activity when a critical vulnerability becomes relevant.
Executive priority
Treat this group as a planning driver for resilience around exposed services, identity security, and incident response speed. The supplied ATT&CK relationships show behaviors spanning web shells, credential access, discovery, command execution, command-and-control, account manipulation, cloud account abuse, and tool transfer. Executives should ask whether asset ownership, emergency vulnerability response, privileged identity controls, logging retention, and IR playbooks are strong enough to support fast decisions during edge-device or cloud-software exploitation scenarios.
Technical view
SOC, detection engineering, and IR teams should validate coverage against the mapped behaviors rather than relying on a group name. Relationship context includes China Chopper and ASPXSpy web shells, PsExec, Impacket, Tarrask concealed scheduled tasks, Covenant, LSASS and NTDS credential access, PowerShell and Windows command shell execution, discovery commands, local and cloud account abuse, account manipulation, ingress tool transfer, and web or non-application-layer C2. Prioritize evidence from internet-facing servers, identity providers, domain controllers, administrative workstations, cloud/SaaS audit logs, and remote management infrastructure. Because the group object has no official ATT&CK detection text and no platforms listed for the group itself, detection should be built from the related software and techniques plus local exposure data.
Likely telemetry
- Internet-facing application, edge device, remote management, and cloud software access logs
- Web server file creation/modification logs and web shell indicators where available
- Endpoint process creation, command-line, PowerShell, and script execution telemetry
- Windows security events and EDR telemetry for LSASS access, NTDS access or copying, and credential-related activity
- Domain controller, Active Directory, and privileged account change logs
Detection direction
- Map detections to the related ATT&CK techniques and software instead of assuming a single HAFNIUM-specific signature will be sufficient.
- Validate monitoring on exposed web, email, remote management, and cloud software assets because the official description highlights those as initial access targets.
- Tune web shell hunting around abnormal server-side script creation, unexpected child processes from web services, and unusual inbound/outbound web traffic while accounting for legitimate administration and application deployment activity.
- Correlate credential-access signals such as LSASS memory access, NTDS access, and domain controller file access with subsequent remote execution, account manipulation, and discovery behavior.
- Review PowerShell, cmd.exe, PsExec, and Impacket-like activity in context: these tools and interfaces can be legitimate, so detections should combine user, host role, timing, parent process, remote source, and privilege level.
Mitigation priorities
- Maintain a current inventory of internet-facing systems, remote management tools, cloud software, and identity integrations so emergency vulnerability response can be scoped quickly.
- Prioritize patching and compensating controls for exposed edge devices and cloud-facing services when relevant vulnerabilities are identified.
- Harden web and application servers with least privilege, restricted script execution paths, file integrity monitoring where feasible, and strong separation between application and administrative functions.
- Strengthen identity controls: enforce least privilege, review local and cloud accounts, monitor privileged group changes, and reduce password reuse that can amplify local account abuse.
- Protect credential stores and domain controllers with strict administrative access controls, enhanced auditing, and rapid investigation procedures for LSASS or NTDS-related alerts.
Additional notes and limits
The ATT&CK object identifies HAFNIUM aliases including Operation Exchange Marauder and Silk Typhoon and describes likely state-sponsored espionage activity operating out of China. The most defensible defensive value comes from the listed relationships: web shells, credential access, account abuse, discovery, execution, C2, and tool transfer. For Glexia service delivery, this supports tabletop scenarios, detection validation, vulnerability prioritization for exposed services, identity-control reviews, and evidence collection for compliance and incident readiness.
The group object does not provide official detection guidance, tactics, or platforms, so platform-specific claims must come from the related software and technique records rather than the group record itself. Local exposure, product configuration, logging quality, and business-critical asset context are required to determine actual risk and coverage. The supplied fields support concern about rapid exploit operationalization for vulnerabilities in edge devices, but they do not by themselves prove current exploitation against any specific organization.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
HAFNIUM
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.