{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "silk-typhoon",
    "slug": "silk-typhoon",
    "name": "Silk Typhoon",
    "shortName": "Silk Typhoon",
    "country": "China",
    "countryCode": "CN",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2020",
    "prominence": 88,
    "tagline": "Ran the ProxyLogon mass exploitation that web-shelled tens of thousands of Exchange servers, then pivoted to attacking the IT supply chain.",
    "bio": "Silk Typhoon — reported as HAFNIUM during its most notorious campaign — conducted one of the most consequential mass exploitation events in enterprise history.\n\nIn early 2021 the group exploited four Exchange Server zero-days, chained as ProxyLogon, to reach unauthenticated remote code execution on internet-facing mail servers. What made the campaign extraordinary was its final phase: in the days immediately before Microsoft's out-of-band patch, the actor shifted from targeted exploitation to indiscriminate mass scanning, dropping web shells on every reachable vulnerable server it could find. Tens of thousands of organisations were compromised in a matter of days — small businesses, local governments, and schools that had never plausibly been intelligence targets. The FBI subsequently obtained court authorisation to remotely delete web shells from hundreds of U.S. servers whose owners had not responded to notification.\n\nSince 2024 the group has shifted strategy toward the IT supply chain. Rather than attacking targets directly, it compromises the IT service providers, identity management vendors, remote monitoring platforms, and privileged access management products those targets depend on — then uses stolen API keys and service credentials to move downstream into many customer tenants at once. Its December 2024 compromise of BeyondTrust led to access at the U.S. Department of the Treasury.\n\nIn July 2025 the U.S. Department of Justice unsealed charges against two Chinese nationals, identifying Shanghai Powerock Network Co. as a contractor operating at the direction of the Shanghai State Security Bureau.",
    "attribution": {
      "sponsor": "China",
      "service": "Ministry of State Security (MSS) — Shanghai State Security Bureau, via contractors",
      "confidence": "confirmed",
      "summary": "The U.S. Department of Justice charged Xu Zewei and Zhang Yu in July 2025, alleging Xu acted at the direction of the Shanghai State Security Bureau while employed by Shanghai Powerock Network Co. Ltd. The indictment covers both the 2021 Exchange campaign and 2020 intrusions targeting COVID-19 vaccine research at U.S. universities. Xu was arrested in Italy in July 2025.",
      "sources": [
        {
          "org": "U.S. Department of Justice",
          "title": "Chinese National Arrested for Computer Intrusions Including 2021 HAFNIUM Exchange Campaign",
          "url": "https://www.justice.gov/opa/pr/chinese-national-arrested-computer-intrusions-including-2021-hafnium-attack-tied-covid-19",
          "date": "2025-07-08"
        },
        {
          "org": "Microsoft Threat Intelligence",
          "title": "HAFNIUM targeting Exchange Servers with 0-day exploits",
          "url": "https://www.microsoft.com/en-us/security/blog/2021/03/02/hafnium-targeting-exchange-servers/",
          "date": "2021-03-02"
        },
        {
          "org": "Microsoft Threat Intelligence",
          "title": "Silk Typhoon targeting IT supply chain",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/",
          "date": "2025-03-05"
        }
      ]
    },
    "motivations": [
      "espionage",
      "ip-theft"
    ],
    "targetSectors": [
      "Technology",
      "Managed Service Providers",
      "Government",
      "Healthcare",
      "Think Tanks & Academia",
      "Legal",
      "Defense",
      "Education",
      "Pharmaceuticals",
      "NGO & Civil Society"
    ],
    "targetCountries": [
      "United States",
      "United Kingdom",
      "Australia",
      "Japan",
      "Germany",
      "Netherlands"
    ],
    "aliases": [
      {
        "org": "microsoft",
        "name": "Silk Typhoon",
        "correlation": "exact",
        "note": "Formerly HAFNIUM"
      },
      {
        "org": "microsoft",
        "name": "HAFNIUM",
        "correlation": "exact",
        "note": "Retired designator; still the dominant name for the 2021 Exchange campaign"
      },
      {
        "org": "crowdstrike",
        "name": "MURKY PANDA",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "UNC5221",
        "correlation": "partial",
        "note": "Overlapping edge-device exploitation cluster; correlation not fully established"
      },
      {
        "org": "secureworks",
        "name": "BRONZE SILHOUETTE",
        "correlation": "partial",
        "note": "Partial overlap in reported activity"
      },
      {
        "org": "kaspersky",
        "name": "Operation Exchange Marauder",
        "correlation": "partial",
        "note": "Volexity's name for the initial 2021 exploitation, widely adopted"
      },
      {
        "org": "cisa",
        "name": "HAFNIUM",
        "correlation": "exact"
      }
    ],
    "tools": [
      {
        "name": "China Chopper",
        "type": "utility",
        "custom": false,
        "description": "Minimal ASPX web shell — the payload dropped en masse during the ProxyLogon campaign."
      },
      {
        "name": "Covenant",
        "type": "framework",
        "custom": false,
        "description": "Open-source .NET C2 framework used for post-exploitation."
      },
      {
        "name": "Nishang",
        "type": "framework",
        "custom": false,
        "description": "PowerShell offensive framework used for reverse shells and privilege escalation."
      },
      {
        "name": "PowerCat",
        "type": "utility",
        "custom": false,
        "description": "PowerShell netcat implementation for tunnelling and reverse shells."
      },
      {
        "name": "Stolen API keys",
        "type": "lotl",
        "custom": false,
        "description": "Cloud and PAM API keys harvested from providers, used to authenticate legitimately into downstream customer tenants."
      },
      {
        "name": "Opera Cobalt Strike loader",
        "type": "loader",
        "custom": true,
        "description": "Custom loader chain observed in later supply-chain intrusions."
      }
    ],
    "techniques": [
      {
        "tCode": "T1190",
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "note": "Exchange, Ivanti, Palo Alto, and Citrix appliances"
      },
      {
        "tCode": "T1199",
        "name": "Trusted Relationship",
        "tactic": "Initial Access",
        "note": "Compromise of IT providers and PAM vendors to reach downstream customers"
      },
      {
        "tCode": "T1505.003",
        "name": "Server Software Component: Web Shell",
        "tactic": "Persistence",
        "note": "China Chopper deployed at scale during ProxyLogon"
      },
      {
        "tCode": "T1550.001",
        "name": "Use Alternate Authentication Material: Application Access Token",
        "tactic": "Lateral Movement",
        "note": "Stolen API keys used to authenticate into customer cloud tenants"
      },
      {
        "tCode": "T1098.001",
        "name": "Account Manipulation: Additional Cloud Credentials",
        "tactic": "Persistence",
        "note": "Service principal credential addition in Entra ID"
      },
      {
        "tCode": "T1114.002",
        "name": "Email Collection: Remote Email Collection",
        "tactic": "Collection",
        "note": "Bulk mailbox export from compromised Exchange servers"
      },
      {
        "tCode": "T1078.004",
        "name": "Valid Accounts: Cloud Accounts",
        "tactic": "Persistence"
      },
      {
        "tCode": "T1213",
        "name": "Data from Information Repositories",
        "tactic": "Collection"
      },
      {
        "tCode": "T1567.002",
        "name": "Exfiltration Over Web Service: Exfiltration to Cloud Storage",
        "tactic": "Exfiltration",
        "note": "MEGA and similar services used for staging stolen data"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2021-26855",
        "firstExploited": "2021-01-03",
        "zeroDay": true,
        "usage": "ProxyLogon SSRF, the entry point of the four-bug Exchange chain. Exploited from early January 2021, escalating to indiscriminate mass web-shelling in the days before Microsoft's out-of-band patch.",
        "source": {
          "org": "Volexity",
          "title": "Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities",
          "url": "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/",
          "date": "2021-03-02"
        }
      },
      {
        "cveId": "CVE-2021-27065",
        "firstExploited": "2021-01-03",
        "zeroDay": true,
        "usage": "Post-authentication arbitrary file write, completing the ProxyLogon chain to write a web shell to an IIS-accessible path.",
        "source": {
          "org": "Microsoft Threat Intelligence",
          "title": "HAFNIUM targeting Exchange Servers with 0-day exploits",
          "url": "https://www.microsoft.com/en-us/security/blog/2021/03/02/hafnium-targeting-exchange-servers/",
          "date": "2021-03-02"
        }
      },
      {
        "cveId": "CVE-2024-3400",
        "firstExploited": "2024-04-01",
        "usage": "PAN-OS GlobalProtect command injection exploited for root access to firewalls at targeted organisations.",
        "source": {
          "org": "Microsoft Threat Intelligence",
          "title": "Silk Typhoon targeting IT supply chain",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/",
          "date": "2025-03-05"
        }
      },
      {
        "cveId": "CVE-2023-3519",
        "firstExploited": "2023-08-01",
        "usage": "Citrix NetScaler unauthenticated RCE used for perimeter access to targeted networks.",
        "source": {
          "org": "Microsoft Threat Intelligence",
          "title": "Silk Typhoon targeting IT supply chain",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/",
          "date": "2025-03-05"
        }
      },
      {
        "cveId": "CVE-2025-0282",
        "firstExploited": "2024-12-01",
        "zeroDay": true,
        "usage": "Ivanti Connect Secure stack overflow exploited as a zero-day against enterprise VPN appliances.",
        "source": {
          "org": "Microsoft Threat Intelligence",
          "title": "Silk Typhoon targeting IT supply chain",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/",
          "date": "2025-03-05"
        }
      },
      {
        "cveId": "CVE-2021-34473",
        "firstExploited": "2021-08-01",
        "usage": "ProxyShell chain exploited after disclosure for continued Exchange access where ProxyLogon had been patched.",
        "source": {
          "org": "CISA",
          "title": "Urgent: Protect Against Active Exploitation of ProxyShell Vulnerabilities",
          "url": "https://www.cisa.gov/news-events/alerts/2021/08/21/urgent-protect-against-active-exploitation-proxyshell-vulnerabilities",
          "date": "2021-08-21"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "salt-typhoon",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both MSS-linked, both exploiting trusted upstream providers to reach many downstream victims at once."
      },
      {
        "relatedActorId": "apt41",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both operate through the PRC contractor ecosystem; both adopted ProxyLogon within days of each other in March 2021."
      },
      {
        "relatedActorId": "apt31",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both MSS provincial-bureau contractor operations with named front companies."
      }
    ],
    "reports": [
      {
        "org": "Volexity",
        "title": "Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Exchange Vulnerabilities",
        "url": "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/",
        "date": "2021-03-02"
      },
      {
        "org": "Microsoft Threat Intelligence",
        "title": "HAFNIUM targeting Exchange Servers with 0-day exploits",
        "url": "https://www.microsoft.com/en-us/security/blog/2021/03/02/hafnium-targeting-exchange-servers/",
        "date": "2021-03-02"
      },
      {
        "org": "Microsoft Threat Intelligence",
        "title": "Silk Typhoon targeting IT supply chain",
        "url": "https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/",
        "date": "2025-03-05"
      },
      {
        "org": "U.S. Department of Justice",
        "title": "FBI court-authorized removal of web shells from U.S. Exchange servers",
        "url": "https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-effort-disrupt-exploitation-microsoft-exchange",
        "date": "2021-04-13"
      }
    ],
    "campaigns": [
      {
        "id": "proxylogon",
        "actorId": "silk-typhoon",
        "name": "ProxyLogon Mass Exchange Exploitation",
        "date": "2021-01-03",
        "endDate": "2021-03-10",
        "significance": "landmark",
        "targetSectors": [
          "Government",
          "Education",
          "Healthcare",
          "Legal",
          "Technology",
          "NGO & Civil Society"
        ],
        "targetCountries": [
          "United States",
          "United Kingdom",
          "Germany",
          "Norway",
          "Australia"
        ],
        "cveIds": [
          "CVE-2021-26855",
          "CVE-2021-27065"
        ],
        "summary": "Four Exchange zero-days chained for unauthenticated RCE. In the days before Microsoft's out-of-band patch the actor shifted from targeted exploitation to indiscriminate mass web-shelling, compromising tens of thousands of organisations. The FBI later obtained court authorisation to remotely remove web shells from U.S. servers.",
        "sources": [
          {
            "org": "Volexity",
            "title": "Operation Exchange Marauder",
            "url": "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/",
            "date": "2021-03-02"
          },
          {
            "org": "U.S. Department of Justice",
            "title": "Court-authorized effort to disrupt exploitation of Microsoft Exchange Server",
            "url": "https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-effort-disrupt-exploitation-microsoft-exchange",
            "date": "2021-04-13"
          }
        ]
      }
    ],
    "flag": "🇨🇳",
    "profile": "/apt/silk-typhoon/"
  }
}