{"actor":{"id":"hafnium","name":"HAFNIUM","aliases":["Silk Typhoon","DEV-0322","Operation Exchange Marauder"],"vendor_names":{"microsoft":"HAFNIUM","crowdstrike":"JUDGMENT PANDA","mandiant":"UNC3944","mitre":"G0125","secureworks":"IRON TYPHOON"},"mitre_gid":"G0125","type":"nation-state","type_verbatim":"nation-state APT","secondary_types":[],"origin":"CN","origins":["CN"],"targets":["AE","US"],"target_regions":[],"sectors":["edu","consulting-professional-services","gov","leg","tec","fin","def","tel","hea","industrials-engineering"],"threat_types":["esp"],"mitre_techniques":["T1560.001","T1033","T1098","T1114.002","T1190","T1218.011","T1119","T1003.001","T1005","T1589.002","T1590","T1583.005","T1016","T1083","T1567.002","T1592.004","T1068","T1550.001","T1059.001","T1199","T1059.003","T1071.001","T1583.006","T1057","T1095","T1564.001","T1078.004","T1583.003","T1003.003","T1105","T1555.006","T1018","T1078.003"],"gir_codes":[],"active_since":2017,"brief":"PRC cluster behind the 2021 Microsoft Exchange ProxyLogon mass exploitation.","attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:22.302989+00:00","updated_at":"2026-07-29T08:59:15.588+00:00","url":"https://aptatlas.net/actors/hafnium"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/hafnium/stix","navigator":"https://aptatlas.net/api/v1/actors/hafnium/navigator"}}