Microsoft Silk Typhoon MAR 2025

HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).

HAFNIUM has collected data and files from a compromised machine.

HAFNIUM has targeted unpatched applications to elevate access in targeted organizations.

HAFNIUM has abused service principals in compromised environments to enable data exfiltration.

HAFNIUM has granted privileges to domain accounts and reset the password for default admin accounts.

HAFNIUM has gained initial access through password spray attacks.

HAFNIUM has used web shells and MSGraph to export mailbox data.

HAFNIUM has used MSGraph to exfiltrate data from email, OneDrive, and SharePoint.

HAFNIUM has created domain accounts.

HAFNIUM has exploited multiple vulnerabilities to compromise edge devices and on-premises versions of Microsoft Exchange Server.

HAFNIUM has used stolen API keys and credentials associated with privilege access management (PAM), cloud app providers, and cloud data management companies to access downstream customer environments.

HAFNIUM has abused compromised credentials to exfiltrate data from SharePoint.

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.

HAFNIUM has exfitrated data from OneDrive.

HAFNIUM has abused service principals with administrative permissions for data exfiltration.

HAFNIUM has moved laterally from on-premises environments to steal passwords from Azure key vaults.

HAFNIUM has incorporated leased devices into covert networks to obfuscate communications.

HAFNIUM has used compromised devices in covert networks to obfuscate communications.

HAFNIUM has discovered leaked corporate credentials on public repositories including GitHub.

HAFNIUM has cleared actor-performed actions from logs.