Murky Panda, a Chinese state-sponsored hacking group also known as Silk Typhoon and Hafnium, exploits trusted relationships in cloud environments to gain access to networks and data of downstream customers. This group targets organizations in North America across sectors such as government, technology, academia, legal, and professional services. Murky Panda has been linked to significant cyberespionage campaigns, including the Microsoft Exchange breaches in 2021 using the ProxyLogon vulnerability, and more recent attacks on the U.S. Treasury’s OFAC and the Committee on Foreign Investment. Researchers reported in March that Murky Panda began targeting remote management tools and cloud services in supply chain attacks. They commonly gain initial access by exploiting internet-exposed devices and services, including vulnerabilities in Citrix NetScaler, Microsoft Exchange, and Ivanti Pulse Connect VPN. Researchers also highlighted that Murky Panda compromises cloud service providers to abuse the trust these providers have with their customers, allowing attackers to pivot into downstream networks. In one instance, Murky Panda exploited zero-day vulnerabilities in a SaaS provider’s cloud environment, gaining access to application registration secrets in Entra ID. This enabled them to authenticate as a service and access downstream customer environments, facilitating email reading and data theft. Another attack involved compromising a Microsoft cloud solution provider to gain Global Administrator rights across all downstream tenants, creating backdoor accounts for persistent access. Murky Panda’s operations are stealthy, blending in with legitimate traffic, and utilizing tools like Neo-reGeorg and China Chopper web shells to maintain persistence. They also employ strong operational security, modifying timestamps and deleting logs to hinder forensic analysis. The use of compromised SOHO devices as proxy servers further obscures their activity. Murky Panda’s sophisticated techniques pose significant risks to organizations reliant on SaaS and cloud providers. CTIX analysts recommend monitoring Entra ID sign-ins, enforcing multi-factor authentication, and promptly patching cloud-facing infrastructure to defend against these threats.