Security Resilience

Threat actor · all actors

HAFNIUMG0125 state

🇨🇳 CN

aka HAFNIUM, Operation Exchange Marauder, Silk Typhoon, ATK233, G0125, Red Dev 13, MURKY PANDA

Last updated: 2026-10-16

24attributed CVEs
66ATT&CK techniques
67.6IDF score (tooling uniqueness)
0exclusive CVEs
2019–2022years active

About this actor

[HAFNIUM](https://attack.mitre.org/groups/G0125) is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. [HAFNIUM](https://attack.mitre.org/groups/G0125) primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. [HAFNIUM](https://attack.mitre.org/groups/G0125) has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: Microsoft Silk Typhoon MAR 2025)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0125

Microsoftweather-system names

Silk Typhoon

CrowdStrikenation-animal names

MURKY PANDA

Unclassifiedno scheme matched

HAFNIUMOperation Exchange MarauderATK233Red Dev 13

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 66 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

2019: 2 CVE published220192020: 1 CVE published120202021: 18 CVE published2021: 16 KEV added3420212022: 3 CVE published2022: 5 KEV added82022
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2019-11510 KEV10.010.01.00002019-05-08see CVE
CVE-2021-22205 KEV10.010.00.99732021-04-23see CVE
CVE-2021-44228 KEV10.010.01.00002021-12-10see CVE
CVE-2019-19781 KEV9.99.81.00002019-12-27see CVE
CVE-2020-5902 KEV9.99.81.00002020-07-01see CVE
CVE-2021-1497 KEV9.99.80.99932021-05-06see CVE
CVE-2021-20090 KEV9.99.80.99982021-04-29see CVE
CVE-2021-22005 KEV9.99.81.00002021-09-23see CVE
CVE-2021-26084 KEV9.99.81.00002021-08-30see CVE
CVE-2021-36260 KEV9.99.80.99872021-09-22see CVE
CVE-2021-40539 KEV9.99.80.98962021-09-07see CVE
CVE-2021-41773 KEV9.99.80.99992021-10-05see CVE
CVE-2021-42013 KEV9.99.80.99962021-10-07see CVE
CVE-2021-42237 KEV9.99.80.99212021-11-05see CVE
CVE-2022-1388 KEV9.99.80.99962022-05-05see CVE
CVE-2022-24112 KEV9.99.80.97442022-02-11see CVE
CVE-2022-26134 KEV9.99.81.00002022-06-03see CVE
CVE-2021-26855 KEV9.59.11.00002021-03-03see CVE
CVE-2021-26857 KEV8.57.80.95762021-03-03see CVE
CVE-2021-26858 KEV8.57.80.93652021-03-03see CVE
CVE-2021-27065 KEV8.57.80.99952021-03-03see CVE
CVE-2021-26412 8.09.10.33762021-03-03see CVE
CVE-2021-27078 8.09.10.32552021-03-03see CVE
CVE-2021-26854 6.56.60.24742021-03-03see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-440 / 6661%
CM-636 / 6655%
AC-332 / 6648%
AC-630 / 6645%
CM-229 / 6644%
AC-228 / 6642%
CA-726 / 6639%
IA-224 / 6636%
AC-523 / 6635%
AC-422 / 6633%
CM-721 / 6632%
SI-321 / 6632%
SI-721 / 6632%
SC-720 / 6630%
CM-519 / 6629%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category