BRONZE SATIN

BRONZE SATIN is assessed to operate on behalf of the Chinese state, likely as a contractor to the Ministry of State Security (MSS), and widely tracked as the group formerly known as HAFNIUM. It is a mature, well-resourced APT with a demonstrated ability to rapidly operationalise zero-day vulnerabilities, scale intrusions globally, and use both on-premise and cloud environments to meet intelligence collection objectives.
The group rose to prominence during its exploitation of Microsoft Exchange zero-day vulnerabilities in 2021, an operation that enabled widespread access to government, defence, and research networks and triggered coordinated international attribution to China. Its targeting profile remains consistent with strategic intelligence priorities, including policy think tanks, government entities, higher education, healthcare, and IT service providers across multiple regions.
Recent reporting indicates BRONZE SATIN has evolved beyond opportunistic vulnerability exploitation toward more scalable and covert initial access methods, notably targeting IT supply chains. This includes compromising managed service providers, remote management platforms, and cloud service providers, then pivoting into downstream customer environments using stolen credentials, API keys, and privileged access tokens. This shift significantly amplifies operational reach and reduces the need for direct exploitation of each victim network.