?????????????????!???????????????

?????

2024????????12?????????????18???,?CNCERT??????(

?????????????????????

(????????????????????????)?????

?Exchange????????????????????2???Exchange?,?,????????????????????????????,???

(?)???????

??????????,??2?????,?????,??????,??????????????/owa/auth/xxx/xx.aspx?????????????????/owa/auth/xxx/yy.aspx,????????????????????????,??????????????,????????????

(?????????????)???????30?

??????,???????????????????????????,?,?????????????????????SSH?SMB?????????????30??????????;????????????????,???????????????????????????????????????????,??????websocket+SSH???????????,?????????????????????????????,???????????????????WeChatxxxxxxxx.exe??2?????PIPE?????,?????????????

??????

(???????????)??????

??????????????,??????,???,?,?,????????????

(??)??????????????????

??3??????,???,2023???????????????5????2??,??????(95.179.XX.XX)????????????????,?????????,?,???????????,??“???”?“??????????????”?“??????”?“????(?+?)”?“??????????????????????IP?”?“?????????”???????

(????????????)??????????????????

?????????????,????????????????,2023???????7??26????????????????????????,????(65.21.XX.XX)?,???????????????????????,???????????????????????,??????????????????????,??1.03GB??????????????????,?“??”?“tip4XXXXXXXX.php”?

(??????????)?

???????????????????,??????????????,?,??????????????????????SSH?,?,?????????????????????????

???

(?????????????)?

???????????????,?????????????????22??????8???????,????10?20??????????????????????????,????????????????????,???????????

(?)?????????

2023?5?2023?10??,???????????????????????30?????????????????????????????????,????IP??????????????????????,????????????????????????????

(??)?

??????????2????????????????PIPE???????????????“c:\windows\system32\”???????,????.net???????,???,????KB,????TLS????????,?????????https?,???????????????websocket+SSH??????????????????????????????????,?????

?????????????????????????IP?

?

2024??12?18??????????,????????????????????????????CNCERT??????(

???????????????

(????????)???????

2024?????????????8???????????????????19?,?????????,???????????????????????????/???????????????????2024??????????8??????21??,??/??????????

(??????????)?

2024?8??????????????????????????21??12??????,??????????????????????,???????????????????????,?????????????????????,??????????/xxx/xxxx?flag=syn_user_policy??,?????/xxx/xxxStats?

(??????????????)?????????????

2024?11?????6????????????2024????11???8???????2024?????????????????11????16?????????????,??????276???????????????????????????????????????????????????

?????????????????????????????

(??????????????????????????????)????????????

?IP??????,????????,????,??????????,????????????????

(????????????)?

2024?11??????????6?????????????????????11?16???????,?3????????????IP??????????,?????,?,?????????????????????,???,??????????????????????????????????????4.98GB?

???

(?)?

??????????????????????,????22??????????????8??????????????,????10?????20??,???,??????????

(????)??????????????

?5??????????????IP????????,????????,?????????

(????)????

?,??????,??

????????,????????????,????????????????????????????

(?)?????????????

????,?,?????,??????????276????????????????,???????????????????????????????,???????????????????

?????????????????IP?????

???:?????????????