Storm-0062

Executive Summary

Storm-0062, also known as Oro0lxy or DarkShadow, is a cyber threat actor linked to China, targeting vulnerabilities in on-premises Confluence Server and Data Center versions. While initial reports indicate exploit-based attacks, their broader strategic goals and other TTPs remain unclear at present.

Goals & Targeting

The actor appears to focus on exploiting known vulnerabilities in widely used server software such as Confluence, targeting organizations that operate these systems in their data centers. Given its suspected Chinese origin, Storm-0062 may align with state-sponsored cyber espionage or theft activities typically seen in nation-state actors. Target selection is likely driven by operational opportunities rather than sector-specific preferences, but campaigns may evolve to focus on critical infrastructure industries.

Storm-0062 gained attention after being identified by Microsoft as a China-linked hacking group exploiting a vulnerability in the on-premises versions of Atlassian Confluence Server and Data Center. The actor is known to leverage server software vulnerabilities for cyberattacks, with their primary campaign involving exploit-based intrusions targeting critical infrastructure and enterprise organizations. Despite this activity, limited information exists regarding Storm-0062's broader objectives, long-term goals, or association with specific sectors outside of the initial findings.

Key Capabilities

• Exploitation of server software vulnerabilities
• Potential phishing and initial access mechanisms

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm-0062 has been observed in limited campaigns, primarily through Microsoft's identification of their activity against Confluence vulnerabilities. The group's operational tempo suggests a focus on high-value targets, possibly within critical infrastructure or government sectors, but specific victims and long-term campaign patterns remain undefined.

IOC Patterns

• Exploitation attempts targeting Confluence Server vulnerabilities
• Network traffic indicating scans for vulnerable Confluence instances

Recommended Actions

• Patch all known Confluence Server and Data Center versions immediately to mitigate zero-day exploit risk.
• Monitor network traffic for signs of exploitation attempts consistent with the known TTPs of this actor.
• Conduct periodic phishing simulations to test employee susceptibility to email-based attacks.

Suggested Tags