From a9a6b0253f13da9623991d4fdceab0a6774c17aa Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 4 Mar 2021 10:49:58 +0100 Subject: [PATCH] chg: [microsoft activity group] HAFNIUM added --- clusters/microsoft-activity-group.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/clusters/microsoft-activity-group.json b/clusters/microsoft-activity-group.json index 3d97ff3..1927f89 100644 --- a/clusters/microsoft-activity-group.json +++ b/clusters/microsoft-activity-group.json @@ -287,7 +287,17 @@ }, "uuid": "99e708f7-1c01-467d-b0da-f6cebd434abc", "value": "GADOLINIUM" + }, + { + "description": "HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA. In campaigns unrelated to these vulnerabilities, Microsoft has observed HAFNIUM interacting with victim Office 365 tenants. While they are often unsuccessful in compromising customer accounts, this reconnaissance activity helps the adversary identify more details about their targets’ environments. HAFNIUM operates primarily from leased virtual private servers (VPS) in the United States.", + "meta": { + "refs": [ + "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/" + ] + }, + "uuid": "fbb66d6c-0faa-49cc-8aa3-2f9bd4e9c298", + "value": "HAFNIUM" } ], - "version": 9 + "version": 10 }