ChinaAttributedMSS, via contract hackersMixedActive 2020 – 2025Silk Typhoon
Also known asHAFNIUM · Red Dev 13 · Murky Panda · Operation Exchange Marauder · BRONZE SATIN
Summary
PRC MSS-linked cluster (Microsoft: Silk Typhoon; historically HAFNIUM). 2021 ProxyLogon Exchange Server zero-day chain at scale. March 2025 Microsoft Threat Intelligence reporting: pivot to IT supply chain targeting — RMM platforms, cloud service providers, identity providers, and privileged access management tools — to reach downstream tenants. Heavy use of zero-day chaining and rapid CVE weaponisation: Ivanti Connect Secure, Fortinet FortiOS, Citrix NetScaler all observed within days of patch release. Wiz Research has published on the group's cloud-tenant pivot patterns. In Apr 2026 Italy extradited Xu Zewei (Shanghai Powerock, tasked by the MSS Shanghai State Security Bureau) to the US for Feb 2020–Jun 2021 intrusions that DOJ places in the HAFNIUM campaign. CrowdStrike (as Murky Panda) saw a surge of cloud trusted-relationship intrusions in North America from late spring 2025. DOJ's Mar 2025 i-SOON release lists Silk Typhoon among APT27's names; Microsoft tracks the two separately, so the equation is recorded as disputed.
Attribution
Tasked by the Shanghai State Security Bureau
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- US Department of Justice (Government, 2026-04-27)
Shanghai State Security Bureau officers directed the HAFNIUM contract hacker - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Likely state-sponsored, operating out of China
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| "Summer of Murky Panda" — cloud trusted-relationship compromises in North America | 2025-05 – 2025-08 | North America | Government, Technology, Legal, Professional Services | CrowdStrike via CyberScoop (2025-08-21) |
| IT Supply Chain Cloud Pivot | 2024 – ongoing | USA, Global IT Providers | Technology (RMM, PAM, cloud app & data-management providers), Government | Microsoft Threat Intelligence Mar 2025 |
| HAFNIUM — COVID-19 research theft and Exchange zero-day intrusions (DOJ: Xu Zewei, Zhang Yu) | 2020-02 – 2021-06 | USA, Global | Healthcare, Research, Academia | US DOJ (2026-04-27) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 15
| Reconnaissance1 | T1593.003Code Repositories |
|---|---|
| Resource Development2 | T1583.005BotnetT1584.005Botnet |
| Initial Access2 | T1190Exploit Public-Facing ApplicationT1199Trusted Relationship |
| Execution1 | T1059.001PowerShell |
| Persistence2 | T1078.004Cloud AccountsT1098.001Additional Cloud Credentials |
| Credential Access3 | T1003.003NTDST1110.003Password SprayingT1555.006Cloud Secrets Management Stores |
| Lateral Movement1 | T1550.001Application Access Token |
| Collection3 | T1530Data from Cloud StorageT1114.002Remote Email CollectionT1213.002Sharepoint |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| CloudedHope | Backdoor / RAT (Go, garble-obfuscated) | Linux |
| China Chopper | Web shell | Windows |
| Tarrask | Defence-evasion malware (hidden scheduled tasks) | Windows |
| Covenant | C2 framework (open source) | Windows |
Exploited vulnerabilities 4
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2024-3400 | 10 | Palo Alto PAN-OS GlobalProtect — command injection, 0-day Mar 2024 (KEV 2024-04-12) |
| CVE-2023-3519 | 9.8 | Citrix NetScaler ADC / Gateway — unauthenticated RCE (KEV 2023-07-19) |
| CVE-2021-26855 | 9.1 | ProxyLogon (Exchange) (KEV 2021-11-03) |
| CVE-2025-0282 | 9 | Ivanti Connect Secure — stack overflow RCE, 0-day (KEV 2025-01-08); Microsoft: Silk Typhoon Jan 2025 — GTIG attributes the 0-day exploitation to UNC5221, which GTIG does not consider the same as Silk Typhoon (KEV 2025-01-08) |
Highest CVSS first.
Infrastructure patterns
- Covert network of compromised Cyberoam appliances, Zyxel routers and QNAP devices (Microsoft, 2025)