Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Storm-0062 · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06

Storm-0062

  • Oro0lxy
  • DarkShadow

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE1 new CVE: CVE-2023-22515

Analyst brief

misp-galaxy

The cyberattack campaign that Microsoft uncovered was launched by a China-linked hacking group called Storm-0062. According to the company, the group is launching cyberattacks by exploiting a vulnerability in the Data Center and Server editions of Confluence. Those are versions of the application that companies run on-premises.

CVEs Storm-0062 is cited as exploiting

none on KEV
  1. CVE-2023-225152026-10-17
    1. “Microsoft has observed nation-state actor Storm-0062 attempting to exploit CVE-2023-22515 in the wild since September 14, 2023.”

      cited as exploiting · source: techcommunity.microsoft.com ↗ · 2026-10-17

    2. “Microsoft has observed nation-state actor Storm-0062 attempting to exploit CVE-2023-22515 in the wild since September 14, 2023.”

      cited as exploiting · source: techcommunity.microsoft.com ↗ · 2026-10-17

    3. “Microsoft has observed nation-state threat actor Storm-0062 exploiting CVE-2023-22515 in the wild since September 14, 2023.”

      cited as exploiting · source: twitter.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Detections

3 rules · Sigma · QRadar · Cortex

  1. CVE exploitation

    CVE-2023-22515 exploitation attempt

    CVE-2023-22515 · Storm-0062 · Ukrainian Cyber Alliance

    T1190conf 70SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

3 sources
  1. 1.techcommunity.microsoft.com/t5/microsoft-365-defender-blog/monthly-news-november-2…
  2. 2.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-we…
  3. 3.twitter.com/MsftSecIntel/status/1711871732644970856

Track Storm-0062 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.