Microsoft identifies “Oro0lxy” as Confluence attacker

A bug in Atlassian’s Confluence data centre and server software is under attack, allegedly from threat actors in China.

Atlassian disclosed the zero-day vulnerability, CVE-2023-22515, last week, saying a small number of customers had suffered exploitation.

Now, in a series of messages posted to X (formerly Twitter), Microsoft said it had identified attack traffic it attributes to a threat actor dubbed Storm-0062, beginning on September 14.

Microsoft sourced the attacks to the following four IP addresses: 192.69.90.31, 104.128.89.92, 23.105.208.154, and 199.193.127.231.

“Any device with a network connection to a vulnerable application can exploit CVE-2023-22515 to create a Confluence administrator account within the application,” the company added.

Microsoft noted that “Storm-0062 is tracked by others as DarkShadow or Oro0lxy.”

While Microsoft didn’t specifically identify China in its messages, Oro0lxy is an alias used by Li Xiaoyu, a Chinese national the US Department of Justice (DoJ) accused of hacking on behalf of China’s Ministry of State Security in a June 2020 indictment [pdf].

The DoJ said Xiaoyu and Dong Jiazhi were prolific hackers who breached hundreds of companies in the United States, Australia, Belgium, Germany, Japan, Lithuania, the Netherlands, Spain, South Korea, Sweden, and the United Kingdom over a 10-year period.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts