?????????????????!???????????????

????:???????ktv????:???????VX

??????

2024?????????12??????????????????????????????????18?,?CNCERT?(

???????????????

(??????????????????????)?

?????????Exchange???2????Exchange?????,?,?????,????????

(?????????????????????????????????)??

????,?2??,?????????????????,????????????????????????????,????????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,??????????????,??????,??

(???)??????30?

??????????,????,?,???????????SSH?SMB????????????????????30????????????????;?????????????,???????????????????????????????????,???????????????websocket+SSH?,?????????????,?WeChatxxxxxxxx.exe????2????????PIPE??????,????????????????????

??????????????????????

(?????????????????)?

???????????????????????,?????????????????????????????,?,?,?,??????

(?????)?????

????????3????????,????????,2023????????????5?2?????????????,?????????????????(95.179.XX.XX)??????????????????,???????????????????????,???????????????,?,???“??????????????”?“???”?“??”?“?????????(?????????+??????)”?“????IP????????????”?“???????????”??

(???????)?

?????,?????????????????????????????????????,2023????????????????7????26???????????????,?????(65.21.XX.XX)?????????????,?????????????????,?,????,????????1.03GB???????????,?????????????“??????????????????????”???????????????????????????“tip4XXXXXXXX.php”?

(????????????)??

??????,??????????????????,???????????,????????????????????????SSH??????????,?????????????????????,?????????????????

?????????????????

(?)?

???,????????????????????????????22???????8?,?????10?20??????????,????,????????????

(????)???????????

2023??????5?2023????10???????????,???30?????????,?IP???????????????,???

(????)??????????????

?2?PIPE??“c:\windows\system32\”?,?.net?,??????????????,?KB,??????????????TLS?????????????????????????????????????????????,?????????https??????,??????websocket+SSH??????????????,?????

?????????????????IP????????????????????

???????????????????

2024????12????18?,???????CNCERT????????(

?????????????????????????????

(???????????)????

2024????????????8???????????????????19????????????????????????????,????????????????????????,???????/????2024??????????????8?21??,???????????????????????/???????????????????????

(??)????????

2024??????8??????????21?????????????????12?,??????????????,?,???????????????????,?/xxx/xxxx?flag=syn_user_policy???????????,???????????????/xxx/xxxStats?

(??????????)?

2024?????????11??????????6???2024?11????????????8?2024?11?16??????????,?276???????????

???????????????

(??????)??

?IP????,??,??????????,?,???????????????????????????????

(???????)?

2024????????????????11???????????????????????6??????11???????????16?????????,?????????3?????????????IP?,????????????????????????,????,??????????????????????,??????????????,?????????????????????????????????????????????????????4.98GB?

??????

(????????)??

????,?22???????????8?????,?????10??????20????,???????????????????,???????????????

(?????)???????????????????????????

????????????5?IP????????????????,????????????????????????,??

(??????????????????)??????????????

???????????????????,???????????????,??????????????

??,?,???????????????

(???????????????)?

?,??????????,????,?????????276??????,??????????????????????????????????????,???????

?????????????????????IP?

??:?????