Summary
- Threat Actor: Silk Typhoon (China-nexus) a.k.a., HAFNIUM, timmy
- Motivation: State-affiliated espionage
- Targeting: Azure and M365 enviornments, Government, IT, MSPs, defense, healthcare, and NGOs
- Attack Types: Zero-days, Entra Connect, abuse OAuth/Graph/EWS for email/data theft
- Defenses: Lock Entra Connect, audit OAuth apps, monitor Graph/EWS, enforce MFA, and segment on-prem/cloud.
If you enjoy reading about cloud threat actors, you might also enjoy our training or investigating your own cloud incidents with Cloud Labs.
Overview
Silk Typhoon, also known as HAFNIUM, is assessed to be a Chinese state-affiliated threat actor first identified in early 2021, driven by espionage motives and targeting sectors such as defense, transportation, media, NGOs, and healthcare. The threat actor gained prominence for exploiting four zero-day vulnerabilities in Microsoft Exchange Server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065) in March 2021, enabling unauthenticated remote code execution and widespread compromise of on-premises Exchange servers. This campaign allowed Silk Typhoon to deploy web shells for persistent access and data exfiltration, targeting thousands of organizations globally.
In February 2025, the threat actor exploited a zero-day vulnerability (CVE-2025-3928) in Commvault’s Metallic Microsoft 365 backup SaaS platform on Microsoft Azure, using web shells to access client secrets and infiltrate customers’ Microsoft 365 environments, showcasing their focus on cloud-based supply chain attacks. By targeting IT supply chains, Silk Typhoon leverages trusted vendor relationships to compromise downstream cloud environments.
Silk Typhoon demonstrates cloud-fluent tactics by exploiting on-premises footholds to pivot into cloud environments, targeting Microsoft Entra Connect servers to synchronize and escalate privileges between Active Directory and Entra ID for lateral movement. Once in the cloud, the group manipulates service principals and OAuth applications with administrative consents to abuse Microsoft Graph and Exchange Web Services (EWS) APIs for targeted exfiltration of email, OneDrive, and SharePoint data.
TTPs
All of the details below are also available in our GitHub repository, which provides background on each observed technique along with corresponding MITRE ATT&CK mappings, making it easy to map these insights directly to your cloud logs.
