Procedure examples

HAFNIUM has used procdump to dump the LSASS process memory.

HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).

HAFNIUM has collected data and files from a compromised machine.

HAFNIUM has collected IP information via IPInfo.

HAFNIUM has checked for network connectivity from a compromised host using `ping`, including attempts to contact `google[.]com`.

HAFNIUM has enumerated domain controllers using `net group "Domain computers"` and `nltest /dclist`.

HAFNIUM has used `whoami` to gather user information.

HAFNIUM has used `tasklist` to enumerate processes.

HAFNIUM has used the Exchange Power Shell module Set-OabVirtualDirectoryPowerShell to export mailbox data.

HAFNIUM has used `cmd.exe` to execute commands on the victim's machine.

HAFNIUM has targeted unpatched applications to elevate access in targeted organizations.

HAFNIUM has used open-source C2 frameworks, including Covenant.

HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.

HAFNIUM has abused service principals in compromised environments to enable data exfiltration.

HAFNIUM has searched file contents on a compromised host.

HAFNIUM has used TCP for C2.

HAFNIUM has granted privileges to domain accounts and reset the password for default admin accounts.

HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.

HAFNIUM has gained initial access through password spray attacks.

HAFNIUM has used web shells and MSGraph to export mailbox data.

HAFNIUM has used MSGraph to exfiltrate data from email, OneDrive, and SharePoint.

HAFNIUM has used ASCII encoding for C2 traffic.

HAFNIUM has created domain accounts.

HAFNIUM has exploited multiple vulnerabilities to compromise edge devices and on-premises versions of Microsoft Exchange Server.

HAFNIUM has used stolen API keys and credentials associated with privilege access management (PAM), cloud app providers, and cloud data management companies to access downstream customer environments.

HAFNIUM has abused compromised credentials to exfiltrate data from SharePoint.

HAFNIUM has used rundll32 to load malicious DLLs.

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.

HAFNIUM has exfitrated data from OneDrive.

HAFNIUM has abused service principals with administrative permissions for data exfiltration.

HAFNIUM has moved laterally from on-premises environments to steal passwords from Azure key vaults.

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.

HAFNIUM has hidden files on a compromised host.

HAFNIUM has exfiltrated data to file sharing sites, including MEGA.

HAFNIUM has operated from leased virtual private servers (VPS) in the United States.

HAFNIUM has incorporated leased devices into covert networks to obfuscate communications.

HAFNIUM has acquired web services for use in C2 and exfiltration.

HAFNIUM has used compromised devices in covert networks to obfuscate communications.

HAFNIUM has collected e-mail addresses for users they intended to target.

HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.

HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.

HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.

HAFNIUM has discovered leaked corporate credentials on public repositories including GitHub.

HAFNIUM has cleared actor-performed actions from logs.