- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- China(high confidence)
- Sources
- 5 sources carry it
- Identifier
- GINC-APT-0432 · oro0lxy
ChinaWhat it is
The cyberattack campaign that Microsoft uncovered was launched by a China-linked hacking group called Storm-0062. According to the company, the group is launching cyberattacks by exploiting a vulnerability in the Data Center and Server editions of Confluence. Those are versions of the application that companies run on-premises.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- Shadow Typhoon, Storm-0062
- Other names
- DarkShadow
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- China Chopper
- Cyber Eye RAT
- CyberGate
- Hacking Team UEFI Rootkit
- Xploit
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de