?

2024???????????12????18????????????,????????????????CNCERT?(

????????????????????

(?)?

?????Exchange?????????????2???????????Exchange?????????,?,??,??

(?????????)????

??????,????2?,??????????????????????????,?????????????????,?/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,?????????????????????????????????????????????????,?????????,????????????????????????

(?)?????????30??????????????

?????,?,?,?SSH?SMB???????????????????????????30????????????????????????????;????????????,?????????????????????????????????,?????????????websocket+SSH??,????????????,?WeChatxxxxxxxx.exe?????2????PIPE????????????????,??

???????????????

(?????????????????????)?

???????????????,??????????????,?????,?,?,????????????????????

(???????)?????

??????????????????????3????????,????????????????????,2023????5????????????2??????????????,??????????????(95.179.XX.XX)?????,???????????????????,??????????????,????,??“?”?“??????????????”?“?”?“?????????(?+?????)”?“????????????????????IP???”?“?”????

(??????????????????)?????

?????????????????,???????????????????????????????,2023??7???????26??????,?(65.21.XX.XX)?????????,??,???????,???,?????????1.03GB????????????????,??“?????????????”????????????????“tip4XXXXXXXX.php”?

(?)?

?,?????????????????????,??????,????????????????????????????SSH???????????????????,???????,?????

?????????????????????

(?)?

?????,???????????????????????22??????????????????????8???????????,??????????????????????????????10?????20????????????,??????,??

(??????)?????????

2023?????????????????????????????????5???2023????????10???????????????????????,??????????????30?????,??IP????????,??

(?)?????????????

????2??????????????????????????PIPE???????????“c:\windows\system32\”??????,????????????????????.net????????,??,??????KB,?TLS??????????????????????????????????????????????????????????,?https?,?websocket+SSH???,????????

??????????????IP??????????????????????????????????

????

2024??????????12???18????,?????????????????CNCERT????(

????????????????

(?)?????????????

2024??????????8???????19??,??,?/???????2024?8?21??????,??/??

(????????)??

2024?8??????????21??????????????????12??????,?????????????????????,??????,????????????????????????????????,?/xxx/xxxx?flag=syn_user_policy???????,?????/xxx/xxxStats?

(???????????)??????

2024??????11???????????6???????????2024???????????????11????8??2024???????????????????????11????16?,?276????????????????????????????

???????????????????

(?????????????)??????????????????????

????IP?????????????,????,???????????????,?,??

(?)????????????????????????

2024???????????11??6??????????11????????????16?,????????????????3????????????????????????????IP??????????????,??????????,?????,???????????????????,??????????????,???????????????????????????????????????????????????????4.98GB?

??????????????????????

(?)?

??,?22?????????8?,???????????10????????????????????????20??????????????,????,??

(????)?????

?5?????????????????IP???????,??,????????????????????

(????)??????

???????????????????????????,???????????????,????

???????,?,?????

(??)???????????????

???????????????????,?,???????????????,??????????276?,???????????????,???????????

???????????????????????IP??

??????????:????????????????????????????

??

??:???????????,??????????,??????????????