???????????????!?????????????????

?????????

2024?????12?????????????18?????????????,?????CNCERT???????????????????????????(

??????????????????????

(?)??

????????????????Exchange???2???????????????????Exchange??????????????,?????,?,???????????????

(??????????????)???????

?,????2?,??????????????,???????????????????????,???????????????????????/owa/auth/xxx/xx.aspx?????/owa/auth/xxx/yy.aspx,???????????????????????????????????????????????????????,?,????????????????????????????

(?)????30?????

???,??,???????????????,????????SSH?SMB?30???????????????????;?,?????????????????????????????????????????????,????????websocket+SSH?,???????????????????????????????,????????????????????????????WeChatxxxxxxxx.exe??2????PIPE????,??

?????????

(??????????????????????????????)??????

????????????????,?????????????????,????,???????,??????????????????,???????????????

(???????????)???????????????????

??????????????????????????3???????????,?????????????????????????????????,2023??????????5??2??????????????????????,??????(95.179.XX.XX)?????,?????????????????????????????????,????,????????????,?“?????”?“???????????????????????”?“????????????????????”?“??(??+????????????????????????)”?“?IP??????????????”?“??”???

(?????????????)??????????

????????,???????????????????????????????,2023?????7??26??????,??????????????????(65.21.XX.XX)?,???????????????,?????????????????,?,?1.03GB??????????????????,????“???????????????????”????????????????????????“tip4XXXXXXXX.php”?

(????)?

???????????,?,?,???????????????????????????????SSH?,??,???????????????

??????

(??)???

??????,?22?????????????????8?,???????????10????20????,??????,?????

(?)?????

2023??5?2023??????????????????????10?,?????30?,????IP?,??

(??????)??????

????2???????PIPE?“c:\windows\system32\”?,??.net???????,????????,????????????KB,?????????TLS????????????????????????????,?https????????????????????????????,?websocket+SSH??????????????????????,??????

????????????????????????IP???????

??????????????????????????????????

2024????12?18??????????????,?CNCERT???????????????(

????????????????????????????????

(????????????)?

2024????????8????????????19??????????,????,??????????????????????????/?????????????2024????8???????????21?,???/??

(??????)????????

2024????????8?21????????????????12???????,??????????,?????????????,?????????????????????,???????/xxx/xxxx?flag=syn_user_policy???????????????,????/xxx/xxxStats?

(????)??????????????????

2024?????????11?6???????????2024?11???????????8?2024?11?16????,???????????????????276??????????????????????????????

????

(???????????????)??

??IP?????????????,?,???????????,?,?????????????????????

(?)?????????

2024?11?6?????????11?16????????????????,???????????3????IP???,??????,???????????????,?????????,??????,????????????????????????????????????????4.98GB?

????????????

(???)??

???????????????????????,?????????22???8??????????,?10?20????????????,??????????,????????

(??????????)????????

?5?IP??????????????,??????????,????

(??)??????????

????????,?????????,???????????

?,???????????????????????,??

(??????)??????????????

????,???????????,????????????,?????????276?????,?????????????,??????????????????????????????????

????????????????????????IP??????