???????????????!?????????????????

????:??????????:????????????

???????????????????????

2024???????????12??????18?????????????,????????????CNCERT?(

???????

(????????)??????????????

???????????????????Exchange??????????????2?Exchange??,???,??????????????????????????,????????????????????

(????????????????????????)???????????????

??,????2?,??,????????????????????????????????????????????????????????,?/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,????????????????????????????,???????????????????,??

(??????????????????????)????30?

????,?,?????,??????????????SSH?SMB????????????????30????????????????;????????,???????????????????????????????????????????????????????????????????,??????????????websocket+SSH??????????????,??????????????????????,??????????????WeChatxxxxxxxx.exe???????????????2???????????????PIPE???????,??

?????????????????????????????????????????????

(??????????????????)?

???,????????????????????,?,?,?,??????????????????

(?)????????????????

????????????3?????????????,????????????,2023?5?????????????2???????????????????,??(95.179.XX.XX)???????,???????????????,????,???,?“???????????????????????”?“?”?“??”?“?(?????????????+?)”?“???IP??????????????”?“????”???????????????

(??????????)???????

????????????????????????,??????????????????,2023???????????????7??26?,????????????(65.21.XX.XX)??????????,?,????????????,??????????????,?????????????1.03GB????????,?????????????“?”????“tip4XXXXXXXX.php”?

(?)?????

???????????,??????,??????????,??????????????????????SSH??????,??????????????????????????????,??????????

??????????

(??????)??

?,??22??????????8????????????????????????????,?10??????20????,?,??????????????

(?????)????

2023??5?????????????2023?10?,?????30?,??IP?????????????????,?????

(?)????????????????????????

??????????????2??????????????PIPE???????????“c:\windows\system32\”?????????,????????.net????????????????,?,??????KB,?????????????????????TLS???????????????????,?????https?,???websocket+SSH??????????????,????????????????

????IP????????????

?

2024???????????????12???????????????????????????18??????????????????????????,?????????CNCERT???????????(

??????

(???????????????????????)???????????????

2024?????????8??????19??????,?,????????????????????/?????????2024?8???????????????????????????21????????????,?/???????

(????)????????

2024?8??21?12?,???????,?????????,????????????????????,??/xxx/xxxx?flag=syn_user_policy????????????,??????????????????????/xxx/xxxStats?

(???????????????????)?

2024????11?????6???????2024????????????????????????11?8???2024?11??????????16?,?????????????????276????????????????????????????

????????????????????

(????????????????????)?????

?????????IP??????????,????,????????,??????,???????

(????????????????)??????????

2024??????????????????????11????6????11??????????????16??????????,????3??????????????????????IP?????????,???????,??,????????????????,?,????????????????????????????????????????????????4.98GB?

????????

(???)???????????????????????

?,???????????22????????????8?????????????????,??10?20??,??????????,???????????

(?????????????????)?

?5???IP????,?,????????????????????

(?????????????????????)?

?????????,????????????????,??

?????????,?????,????????????????

(?)??

????????????????,?,?,?????276????????,???,????????????????

???IP?

??:??