Signalis
sign in--:--:--UTC
Threat actors

HAFNIUM

☆ pin
MITRE G0049Also known as Hafnium, Silk Typhoon
Reports
3
First seen
Mar 3, 2021
Last seen
Aug 10, 2026
Motivation
Espionage

Relationships

CVE-2021-26855, in 2 of HAFNIUM's reports, exploited in the wild×2CVE-2021-26855CVE-2025-25257, in 1 of HAFNIUM's report, exploited in the wildCVE-2025-25257Co-mentioned with HAFNIUM in 1 Signalis report (co-mention, not confirmed collaboration)×1xuzeweiReports targeting OtherOtherReports targeting GovernmentGovernmentHAFNIUM

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Other ×1Government ×1
Victim regions
United States ×1

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×4T1547.005 Startup Folder ×1T1001 Data Obfuscation ×1T1105 Ingress Tool Transfer ×1T1053.005 Scheduled Task ×1T1003 OS Credential Dumping ×1T1140 Deobfuscate/Decode Files or Information ×1T1059.001 PowerShell ×1T1036 Masquerading ×1T1505 Server Software Component ×1T1505.003 Web Shell ×1

Indicators

hash_sha256 ×5domain ×4filename ×2registry_key ×2hash_md5 ×1cve ×1ip_v4 ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-26855 (exploited)CVE-2025-25257 (exploited)

Recent reports

Critical

Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest

Huntress BlogHigh

Risky Business #799 — Multiple critical vulnerabilities and breaches across tech vendors

Risky BusinessCritical

Rapid Response: Mass Exploitation of On-Prem Exchange Servers

Huntress Blog

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans