Storm-0062 is a China-linked hacking group known for exploiting Confluence Data Center vulnerabilities.
Storm-0062 (also known as Oro0lxy, DarkShadow) is a China-linked hacking group. The group targets organizations by exploiting a vulnerability in on-premises Confluence Data Center and Server editions. Their main TTPs include exploiting the Confluence flaw, likely deploying web shells and establishing C2 communication. Defenders should prioritize patching Confluence instances, monitoring servers for suspicious processes, and blocking unauthorized remote access attempts.
The cyberattack campaign that Microsoft uncovered was launched by a China-linked hacking group called Storm-0062. According to the company, the group is launching cyberattacks by exploiting a vulnerability in the Data Center and Server editions of Confluence. Those are versions of the application that companies run on-premises.
Storm-0062 exploits a vulnerability in on-premises Confluence Data Center and Server editions.
Defenders should prioritize patching Confluence instances, monitoring servers for suspicious processes, and blocking unauthorized remote access attempts.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.