?????????????????!???????????????

??

??????

2024?12??????18?,????????CNCERT???????????????????????????(

???????????????????

(??)???????????????

????????Exchange??????????????2?Exchange??????????????????????,?,?,???

(?)????

????????,?????2???????????????,?,???????????????????????????,???/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,??????????????????????????????,?????????,?????????????????????????

(??)???????30???????????????????

?????,??????????????,?,??????????????????????????SSH?SMB?????30????????????????????????????;?????????,???????????????????????????????????????,?websocket+SSH?????????????,??????????????????????,?????????????????WeChatxxxxxxxx.exe?????????????????????2???????????????????PIPE????????,??????

???????????????????????????????????????????????????

(???????)?

????,????,?,?,???????????????,??

(????)?????????????????????????????????

??????????????3??????????,???????????????????????????????????????????,2023???????????????????????5??????????????????????2??????????????,????????????????(95.179.XX.XX)?????????,???????,?,??????,???“?”?“??”?“?????????????”?“???????????(??????+??????)”?“????????????????IP???????????????????????”?“??????”???

(??????????????)?????

??????????????????????????,???????????????????????????????????,2023?7?????26???,???????????????????????????(65.21.XX.XX)?,?,???,????????????????????????????,??????????????????????????1.03GB??????????,???????????????????“??”?“tip4XXXXXXXX.php”?

(?)?

?,???,????????????,????????????????????????SSH?????,??????????????????????????????????,???????????????????

????????????????????????

(??????)????

????,????22?8?,????????10???????????????????20????????,??????,??

(?????????????????????)????

2023?5????????2023???????10?,????30??????????????????,?IP??????????????,????????

(???????????????)???????????

???2?????????PIPE???????????“c:\windows\system32\”?????????,????.net??,?,????????????KB,?????TLS????????????????????????????????????,?????????https?????????????,???????????????websocket+SSH????????????,????????????????????????

??????????????IP?

??????????

2024?12????18????,??????CNCERT?(

???????????????????????????????????

(??????????????)???????????????

2024?8?19??,???,?????/?????????????????????2024?8??????????????21???????????,???????/??

(????)?

2024?8?21?12?,?????????????????,??????????,????????????,?????/xxx/xxxx?flag=syn_user_policy??????,?/xxx/xxxStats?

(???????)?

2024??????????11??6??2024???11?????????8????????????2024??????11?16???????????????????,??????????276?????????????????????????

????????

(??????????????????????)????

?IP??,??????????,???????????,??????????,?????

(??????????????????????)??????????????

2024?11???????????6????11?????????????16??????????????,?3????????IP?,????????????????,?????,??????,???????????,???????????????????????????????????????????????????4.98GB?

???????????????????

(??????)?

??????????,??????????????????22?8???????????????????,???????????10????20????????????????????????,??,??

(?????????????????)??

??5??????IP????????,?????,????????????????????

(?)?

??????,????????,?????

??????????,?,??

(???????????)??

?????????????,??????????,?????????????????,????276?,????????????????????,????????????????

???????????????????IP??????????

??????:???

?????????

??????????????????????!????????????????????

????????