HAFNIUM Never Left. It Moved Into Your Vendors' API Keys, Where Blocklists Can't See It. Everything We Know About Silk Typhoon, and One Correction.
Most defenders remember HAFNIUM from March 2021, when it mass-exploited Microsoft Exchange through the ProxyLogon flaws and left web shells on tens of thousands of servers. Microsoft now calls the same actor Silk Typhoon, and CrowdStrike tracks overlapping activity as Murky Panda. In the five years since ProxyLogon, it has changed the way it gets in, and the change matters more than any single campaign. It stopped needing infrastructure of its own.
We went back through everything we hold on this actor and everything public through this week. Our coverage was thinner than it should have been, and one of our older posts needs a correction.
Who it is, and which names are really the same
Microsoft labels the actor "Silk Typhoon (HAFNIUM)" and assesses it as a Chinese state espionage group. CrowdStrike says its Murky Panda activity aligns with what others track as Silk Typhoon. Those two aliases are solid, and our profile now lists both.
Two other names travel with it in news coverage, and we are deliberately not merging them. A March 2025 Justice Department affidavit lists APT27, Silk Typhoon, UNC5221 and UTA0178 among the names used for the activity it describes. But Microsoft maps APT27 to a different cluster, Linen Typhoon, and Google has reportedly said UNC5221 is separate. Merging aliases that the researchers themselves disagree on is how two actors' indicators end up in one bucket. We record those names as contested.
What changed: the IT supply chain
In March 2025 Microsoft reported that Silk Typhoon had shifted to the IT supply chain. Instead of breaking into each target, it steals API keys and credentials from the companies that serve them: privileged-access-management vendors, cloud application providers and data-management firms. With those keys it reaches the downstream customers' environments as a trusted party. Microsoft also tied it to a zero-day in Ivanti Connect Secure, CVE-2025-0282, in January 2025.
The most important line in Microsoft's report, for anyone who runs a blocklist, is that Silk Typhoon is not known to use its own dedicated infrastructure. It arrives through the vendors you already trust, using their access. There is little for an indicator feed to match, and Microsoft's report published no indicators at all.
CrowdStrike's August 2025 Murky Panda report shows what that looks like in the cloud. The group abused application secrets in Entra ID and Microsoft's delegated administrative privileges, the access that partners and resellers are granted into their customers' tenants, to move from a compromised supplier into its customers. It also used a custom Linux remote-access tool CrowdStrike calls CloudedHope, and it exploited the Citrix NetScaler flaw CVE-2023-3519 for initial access.
The indictments
In March 2025 the Justice Department charged twelve people, including employees of the Chinese contractor i-Soon and two men it accused of separate intrusions, and seized domains and a cloud hosting account used in the operation.
In July 2025 Italian police arrested Xu Zewei in Milan at the request of the United States. An indictment unsealed in Texas charges him and Zhang Yu over intrusions the Justice Department describes as part of "the HAFNIUM campaign," including attacks on COVID-19 research in 2020, carried out on behalf of China's Ministry of State Security through a Shanghai company. Xu was extradited to Houston in April 2026 and reportedly pleaded not guilty. Zhang remains at large.
What to do about an actor that does not bring its own infrastructure
Treat your vendors' access as your perimeter. Inventory every application registration and service principal in Entra ID, rotate their secrets, and remove any you cannot explain. Move partners and resellers from the old broad delegated admin model to granular delegated admin (GDAP) with the least roles they need, and remove relationships you no longer use. Alert when someone adds a new credential to an application, and when sign-ins come from partner tenants at unusual times or from unusual places. Ask your privileged-access and cloud-management vendors how they protect the keys they hold for you, and how fast they would tell you if those keys were stolen.
Patch the edge devices this actor has used to get in: Exchange, Ivanti Connect Secure and Citrix NetScaler. All the vulnerabilities named above are in CISA's Known Exploited Vulnerabilities catalog.
What our feed and our archive held, honestly
Before today, our feed held zero indicators attributed to HAFNIUM, Silk Typhoon or Murky Panda, from any source. Our archive held one post about this actor, from August 2025, on Murky Panda's Entra ID abuse. Our adversary profile still described it as it looked in 2021.
Today we updated the profile with the aliases, the contested names and the 2025 to 2026 developments. We added nine indicators from the Justice Department's 2025 affidavit, under source manual-batch-hafnium-2026-10: five phishing domains, all seized by the FBI, and four cloud addresses from 2024. We scored them between 35 and 70, below our own edge shield's blocking floor, for two reasons. The domains are seized and the cloud addresses have very likely been handed to someone else since. And the affidavit ties this infrastructure to APT27 and Silk Typhoon, which, as above, is contested. These are for searching your logs backward, not for blocking.
The correction
Our August 2025 post on Murky Panda said the group exploited the Commvault flaw CVE-2025-3928. Coverage at the time reported that, but CrowdStrike's report as it reads today names only the Citrix flaw, CVE-2023-3519, and carries no note explaining the difference. We cannot confirm the Commvault link from CrowdStrike's own text, so we are withdrawing it. The defensive advice in that post stands.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=hafnium-silk-typhoon-moved-into-vendor-api-keys-everything-we-know-and-one-correction
Comments