Silk Typhoon
Silk Typhoon is a China-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 11 sectors, including Government and Technology, in 21 countries, including the United States and the United Kingdom. It uses 61 MITRE ATT&CK techniques and exploits 17 known CVEs.
- Operation Exchange Marauder
- Hafnium
- Red Dev 13
- Murky Panda
- G0125
- Origin
- China
- Techniques
- 61
- Exploited CVEs
- 17
- First seen
- Jan 1, 2021
- Last seen
- Mar 5, 2025
- Record updated
Who They Target.
About Silk Typhoon.
HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA. In campaigns unrelated to these vulnerabilities, Microsoft has observed HAFNIUM interacting with victim Office 365 tenants. While they are often unsuccessful in compromising customer accounts, this reconnaissance activity helps the adversary identify more details about their targets’ environments. HAFNIUM operates primarily from leased virtual private servers (VPS) in the United States. Supporting statements were also issued by NATO, the UK government, the European Union Council, Australia, Japan, Canada, Latvia, Lithuania, Estonia, Slovenia, Finland, and Denmark.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.