Silk Typhoon

Silk Typhoon — reported as HAFNIUM during its most notorious campaign — conducted one of the most consequential mass exploitation events in enterprise history.

In early 2021 the group exploited four Exchange Server zero-days, chained as ProxyLogon, to reach unauthenticated remote code execution on internet-facing mail servers. What made the campaign extraordinary was its final phase: in the days immediately before Microsoft's out-of-band patch, the actor shifted from targeted exploitation to indiscriminate mass scanning, dropping web shells on every reachable vulnerable server it could find. Tens of thousands of organisations were compromised in a matter of days — small businesses, local governments, and schools that had never plausibly been intelligence targets. The FBI subsequently obtained court authorisation to remotely delete web shells from hundreds of U.S. servers whose owners had not responded to notification.

Since 2024 the group has shifted strategy toward the IT supply chain. Rather than attacking targets directly, it compromises the IT service providers, identity management vendors, remote monitoring platforms, and privileged access management products those targets depend on — then uses stolen API keys and service credentials to move downstream into many customer tenants at once. Its December 2024 compromise of BeyondTrust led to access at the U.S. Department of the Treasury.

In July 2025 the U.S. Department of Justice unsealed charges against two Chinese nationals, identifying Shanghai Powerock Network Co. as a contractor operating at the direction of the Shanghai State Security Bureau.