??????????????

2024?12??????????????????????????18?,??????????CNCERT??????????????(

?????

(??)?????????????

???????Exchange???????2???????Exchange?,??,??,????????????????????

(??????????)??????

?,??????2?,?,???????????????????????????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????????????????????????,????????????,??

(??)????????????30???

??????????,?,????????,?????SSH?SMB????30??????????????????????????;????,????????????????????????????????????????????????????????,????websocket+SSH????????????????????????,??????????????????????,???????????????????????WeChatxxxxxxxx.exe?????????????????????2????????PIPE??????????,???????????

????????????????????????

(?)???????????????????????????

?????,?????????????????????????,?????????????????,?????????,??????????????,??????????????????????

(??)????????

?3?,?????????????????????????????????????,2023????????5??????????????????2????,?(95.179.XX.XX)??????,????,??????????????,?????????,?“?”?“?????????”?“??????”?“?????????????(????+???)”?“?IP??????????????”?“?????????????????”???

(?)???????????????

???????????????????????,???,2023???????????????7????????26??????,??????????(65.21.XX.XX)?????,?,???????????????????,??????,???????????????1.03GB????????,?????“??????????????”????????????????“tip4XXXXXXXX.php”?

(???????)?????????????

????????,?,??,???????????????????????????SSH??????????????,?????????????,??

????????

(?)???????????????

?,?22???????????8????,??????????????10??????????????????????20????????????,???,??

(???????????????????????)??????????????

2023???????????????????????????5?2023????????????????????????10??????,?30???????????,??????????????IP???????????????????,??

(??????)???????????????

??????2?PIPE????????“c:\windows\system32\”?,?.net????,?????,????????KB,?TLS?????????????????????????????,?https??????,??websocket+SSH????,??????????

???????????????????????????????IP????

??

2024???????????????12????????????18??????????????,??????CNCERT?(

????????????????????????????

(??????)?

2024??????????????????????????8???????????19??,???????,????????????????/???????2024?????8?21?,?/??????

(??)??

2024???????????8?21??????????12??,?????????????????????????????,?,???????????????,??????????????????????????????/xxx/xxxx?flag=syn_user_policy?????????????????????????,?/xxx/xxxStats?

(?)?

2024??????11????????????????????????????6?????????????????2024?????????????11?8?????2024?11?????16?????,???????????276?????????????

??????????????????

(???????)?

?????IP?,?????????,???????????,????,?????????????????????????????

(?????????)?

2024???????11?????????????????????6??????????????11????16???????????????,???3?IP???????????????????,???????????????,???????????,???,???????,?????????????????????????????????????????????4.98GB?

???????????????????????

(???????????????????????????)???????????????????????

????,????????????22?8?????,????10?20?????????,???????????????,?????

(???)?????

??????????5??????????IP???,??,?????

(????????????????????)?

??,????????,????????

?,?,??????????????????

(???????????????????)?????????

??????,????,?????????????????,?276?????????,?????????????????,????????

???????????????????????????IP????

?????????????:??????????????????????????????????

??

??:???????????,??????????,??????????????