?????????????????!???????????????

???????????????

2024??????????????12?18?????????????,?????CNCERT????????????????????????????(

???????????????

(???????)??

?Exchange??????????????????2?????????????????????Exchange????????????????,??,??????????????,???????????????

(??????????)?????

??,??????????????2???????????????????,?,???,??????????????/owa/auth/xxx/xx.aspx??????????????????????????/owa/auth/xxx/yy.aspx,????????????????????????????????????????????????????????????????????,??????????????,??

(???????????????????????????)??30????

???????????????,???????????????????,???????????????????????????,??????SSH?SMB?30????????????????????????????????????????????????????????;?,???????????????????????????????????????????????????????????????,?websocket+SSH???????,?????????,?WeChatxxxxxxxx.exe?????2?PIPE??????,????????????

???????????????????

(?????????????)???????????????????????

?,?????????????????,??,???????,???????????,??

(??????????????????????)?

?3???,????????????????????,2023????????5????2?,???????????(95.179.XX.XX)??????,??????????,???????????????????,?,??????????????????????????“????”?“??????”?“????”?“????????(?????????????+?)”?“??????IP??????”?“???????????????????”???????????

(?)?

???????,??????????????????????????????,2023??????????????7?26?,??????????(65.21.XX.XX)??,?????,?????????????,??????????,??????1.03GB?????????????,?“?”???????????“tip4XXXXXXXX.php”?

(??)????

????????????,????,???????,???????????????????????????????????????????????????????????????SSH?,?,??????????????

????????????????????????????????

(????)??????????

?????,?22????????????8??,???????????10?20?,????,???????????????

(?)?

2023???5??2023?????????10???????,??????????30??????????????,?????IP?????????????????????????????????,?????

(?)????

????????????????????????2?????PIPE?“c:\windows\system32\”???????????,???????????????.net?????,?,???????????????????????KB,??????TLS???????????????????????????,?https????????????,??????????????????websocket+SSH?????????,??

???????????????????IP?????

??????????????

2024???????????12?????????????????18??,????????CNCERT??????????????(

???????????????????????????????????????

(??????)?????

2024????8?19?????,???????????????,?????????????/????????????????2024????????????8??????????????????21????,??????/???????????????????????

(?????????????????????)?

2024??8?21????????????12?????????,???????????,????????????,???????????????????,????/xxx/xxxx?flag=syn_user_policy???,??????????/xxx/xxxStats?

(?)????

2024??????11?6??2024?11??????????????????????8???????????2024?????????11??????????16????,?276?????????????????????????????????

????????????

(??????????)?

???????????????IP??????????????,?????????????????,?,???????,????

(????????????????????)???

2024????????11??????????????????????6????11?????16?????,????3?IP???,??????,??????,????????,????????,??????????????????????????4.98GB?

????????????????????

(????????)????????

?,???????????????????????22?8??????????,?10?20???????????????,??????,???

(?)?

?5?IP?,???????????????????,???????????????

(???????)??

???????????????????,?????????,???????????

??,???????????????,????????????????????????????

(?)?????

???????????????,???????,???,?????276?,???,?????????????????

??????????????IP?????????