China’s Covert Capabilities | Silk Spun From Hafnium

This report investigates the Hafnium (aka Silk Typhoon) cluster and affiliated companies named in U.S. indictments, revealing that firms tied to indicted operators filed patents for intrusive forensic and offensive tooling (including Apple device file recovery, mobile forensics, and router/network collection). It links these companies to China’s MSS/SSSB, discusses the exploitation of Microsoft Exchange Server ProxyLogon zero-days and subsequent widespread abuse, and highlights attribution challenges arising from corporate structures, subcontracting tiers, and potentially unobserved tooling.