Silk Typhoon
China
Tracked by CyberSIXT since 24 Aug 2025
- Articlesall time
- 10
- Articleslast 30 days
- 3
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 0
12 articles from 5 outlets since 24 Aug 2025; the latest 18 days ago.
- Article
Show as table
Profile
Written by CyberSIXT from the sources listed below. Updated 26 Oct.
Microsoft tracks Silk Typhoon and lists HAFNIUM as an alias2. MITRE ATT&CK describes Silk Typhoon as a likely state-sponsored cyber espionage group operating out of China, active since at least January 2021, primarily targeting US entities1.
SecurityWeek reported that the State Department offered up to $10 million for information leading to the capture of Zhang Yu, charged over alleged involvement in the campaign3. It reported that Xu Zewei was extradited to the US in April 2026 and that the pair allegedly exploited Microsoft Exchange Server vulnerabilities in 20213. MITRE ATT&CK lists China Chopper, ASPXSpy and Tarrask among software associated with Silk Typhoon4.
Sources
- Silk Typhoon: description · MITRE ATT&CK
- Silk Typhoon: alias · Microsoft
- US Offers $10 Million Reward for Suspect in Microsoft Exchange Attacks · SecurityWeek · 2026-10-08
- Silk Typhoon: software · MITRE ATT&CK
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Diamond Model
What the record links to Silk TyphoonRecorded associations sorted by Diamond Model vertex. They do not reconstruct an intrusion or establish a campaign. Model: Caltagirone, Pendergast and Betz (2013).
Names and sources
- HAFNIUM
- CyberSIXT coverage, Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- ATK233
- Malpedia, MISP Galaxy
- G0125
- Malpedia, MISP Galaxy
- MURKY PANDA
- Malpedia, Microsoft, MISP Galaxy
- Operation Exchange Marauder
- Malpedia, MISP Galaxy, MITRE ATT&CK®
- Red Dev 13
- Malpedia, MISP Galaxy
- Silk Typhoon
- Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
- timmy
- Malpedia, Microsoft
Attributed facts
- Origin
China Microsoft · Silk Typhoon, MISP Galaxy
- Category
State Microsoft · Silk Typhoon
Malware and tools
Malpedia · hafnium 2
MITRE ATT&CK® techniques
44 techniques · 14 tacticsFrom MITRE ATT&CK® · G0125
Reconnaissance 5
Resource Development 4
Initial Access 4
Persistence 5
Privilege Escalation 4
Stealth 4
Defense Impairment 1
- T1685.005
- Clear Windows Event Logs
Credential Access 4
Discovery 6
Lateral Movement 1
- T1550.001
- Application Access Token
Collection 6
Command and Control 4
Exfiltration 1
- T1567.002
- Exfiltration to Cloud Storage
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- US Offers $10 Million Reward for Suspect in Microsoft Exchange AttacksSecurityWeek
- US Offers $10 Million Reward for Alleged HAFNIUM Campaign DirectorSecurity Affairs
- US Offers $10 Million Reward for Suspected HAFNIUM HackerThe Hacker News
- US extradites Chinese national over Typhoon university hacksSecurityWeek
- US extradites Chinese hacker over COVID 19 mail server hackInfosecurity
- Chinese Hacker Extradited to US Over COVID19 Vaccine Data TheftThe Hacker News
- Chinese hacker extradited from Italy to US for cyber espionageDataBreaches
- Italy to Extradite Chinese Hacker Xu Zewei to US Over COVID‑19 Cyber EspionageSecurity Affairs
- BRICKSTORM Malware: China-Linked Hackers Stealthily Target US Tech and Legal Firms for 393 DaysSecurityOnline
- China linked Silk Typhoon targeted diplomats by hijacking web trafficSecurity Affairs
- Silk Typhoon hackers hijack network captive portals in diplomat attacksBleepingComputer
- China-linked Silk Typhoon APT targets North AmericaSecurity Affairs · first in our coverage