??
?
2024??????????????????????????????????12???????18????????,?CNCERT?(
??????????????????????????????
(??????????)?
?Exchange???????????????2?????????????Exchange???????????,?,???????????????,??
(?)?????????????????
?,???????2???????????????????,??,?????????????????,????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????,???????????????,?????????????????
(????????)??????????????30???????????????????????
????,????,?????,???????SSH?SMB??????????????30???????????????????;???,?????????????????????????????????????????????????????????,?websocket+SSH??,?????????????,????????????????WeChatxxxxxxxx.exe?????2???????????????PIPE?,?????????????
?????????????????????????
(????)?????????
?????????????,?????????????????,??,?,??????????????????????,???????????????????????
(?)??????????????
???????3??,??????,2023??????????????5?????????????????2?,????????????(95.179.XX.XX)???????????,?????????????????,?,?????????,??????????????????????????????????(?????????????+?)??????????????IP????????????????
(?)?
?????????????????????????????????????,????????,2023?????????????????7????????????????????????26?,?????????????(65.21.XX.XX)??,?,?????,?,???????1.03GB???,????????????????????????????tip4XXXXXXXX.php?
(????????????????????)??
?????????????????????,??,?????,??????????????????????????????????????????????????????????????SSH???????????????,???????????????,????????????????
???????????????
(?)????????????????
??????????,????22????????????8????,????????????10??????20?,???????????????????,???????????????????????????
(?)???????????????????
2023??????????5???????????2023??????????????10?,???????????????????30??????????????????????,??????IP????????????,??
(??)??
????????????????2????????????PIPE????????c:\windows\system32\?,??????????????.net??????????????????????????????,??????????????,??????????????KB,?TLS???????????????????????????????????,?????????????????????????????????https??,????????????????????websocket+SSH??????????,?????
?????????????????????????????????????IP????
?????
2024???????????????????12?18?,???CNCERT??????(
??????????????????????????
(??????????)????
2024????8???????????19????????,?,?????????/??2024????8?????????????21?????????,???????????/???
(???)???????????????
2024??????????????8????????????????????????????21???????12?,????????,??????,???????????????????????????????,?/xxx/xxxx?flag=syn_user_policy??????,????????????/xxx/xxxStats?
(??)???????????????
2024?11????6????2024?????????11??????????8???2024???????????11??16???????????????????????,?????276??????????????????????
???
(?)????????
??IP?,????,?,??????????,??
(?)???????????????????????
2024?????????????????11????????6???????11??????????????????16??,?3???????????????????????????IP????,?????,?,??????????????????,?,???????????????????????????????????????????4.98GB?
?????????????????????
(?)??????
????,??????????????22??????????????????????????8???,?10????20?,??????????,??
(?????????)?????
???????????????????????????5????IP??????,??????,???????
(?)????
??????????,??????????,????????????
??????????,?????,?????
(?)????????
??,?,?,?????????????????????276??????????????,???????,????????????????????????
?????????IP?
??:????????????????
????????????????????!??????????????????????????????