Murky Panda hackers exploit cloud trust to hack downstream customers

Murky Panda (Silk Typhoon/Hafnium) is a sophisticated state‑sponsored APT that targets government, technology, academic, legal, and professional services organizations by exploiting internet‑exposed vulnerabilities and compromising cloud providers and managed service relationships to pivot into downstream customer environments; the group has used zero‑day exploits, abused Entra ID service principals and delegated administrative privileges to read emails and steal sensitive data, and employs web shells and a Linux RAT (CloudedHope) while maintaining strong OPSEC.