?????????????????!???????????????

??

????

2024??????????????12??????????????18?,???????????????????????CNCERT????????????????(

????????????????????

(??)??????????????

?????????????Exchange???????????????????????????????????????2??Exchange????,?,??????????,??

(?)????

????????,?2?,??????????,?????????????????????????,??????/owa/auth/xxx/xx.aspx??????????????????????????/owa/auth/xxx/yy.aspx,?????????????????????????????????????,?,????????????????????????????

(??)???????????30???????????

??????????,??????,??????????,??????SSH?SMB??30???????????????;?????????????????????????????????,?????????????????????????????????,?????websocket+SSH????????????????????????,????????????????????????,???????????????WeChatxxxxxxxx.exe?????????????????????????????2?????????????PIPE?,???????

???????????????????

(??)??????????????

???????,?????????????????????????????????,?,????????,????????,?????

(???)?????????

????3????,????????????????????????,2023?????5???????2???????,?(95.179.XX.XX)??????????????,???????????????????,?????????????,??,??“?”?“?????????????”?“?????”?“?????(?????????????????+???????????)”?“?IP????”?“?”?????

(??????)?

?????,??????????????????????,2023???????????????7????26??????,?????????????(65.21.XX.XX)???????????,????????????????,????,??????????,??????1.03GB????,?“??????”????????“tip4XXXXXXXX.php”?

(?????????????????????)??????????

?,??????????,?,?????????????????????SSH??????????,??,??

???????????

(?)?

?????????????????,??????????????????22????8?,??????10???20???????????????,???,??

(?)??????

2023????????????5???2023??10??????????????,???????30?,????????IP????????,????????????

(?????)???????????????????????

?2????PIPE????????????“c:\windows\system32\”??????????,?.net?,?,?????????????????????KB,????TLS????????????????????????????????,???????https????,???????websocket+SSH??,??

?????????????????????????IP??????????????

???????

2024??????????????????????12????????????????18??????????,???????????????CNCERT?(

???????????????????????????????????????

(?)?

2024???????????8?19????????????,?,??????????????/????????2024????????????8?21??????????,?/????????

(??????)?????????

2024?????8?21?????????????12???????????,???????????????????????,??????????????????????????????????,?????????????????????,?????/xxx/xxxx?flag=syn_user_policy????????????,?/xxx/xxxStats?

(??)?????????

2024?11??????????6?????????????????????????2024?????????11??????8??????????????????2024?11???????????????????????????16???????????????????,?????276?????????????????????????????????????????????

??????????????????????

(?)?????

????????????????IP?,???????????????,?,????????????,???

(?)??????????

2024?????????????????11????6?11???????????????16?,?3???????????????????IP???????????????????????????,????,?,?????????????????????,???????????,??????4.98GB?

????????????

(???)?????

??,??????22????????8????????????????????,???????????10????20??????????????????????????,??????????????????????,??????

(??????)?

?5?IP?,????,?????

(??????????????)??????????????

?,???,????????????????????

???????????????,??????????????????????,??????????

(?????????)???

?????????????,?,?,?????????????276?????????,?????????????????????????????,??????????

????????????????????????????????????????IP??????

??:??????

?????????

??????????????????????!????????????????????

????????