?????????????????!???????????????
?
2024??12??18???????????????????,???????????????????????CNCERT????????????????(
??????
(??????????????)?
?????Exchange????????2???????????????Exchange???????????????,?,??????????,????????????????
(??????)????????????????????????
?,????????????????????2??????,?????????,?????????????????????????????????????,???/owa/auth/xxx/xx.aspx?????????????????/owa/auth/xxx/yy.aspx,????????????????????????????????,?????????,????????????????????????
(???????????????)?30?
???????????,?????,???????????,?SSH?SMB?30?????????????????;??????????,?????????????????????????????????????????????????????????????????????????????????????????,????websocket+SSH????,?????????????,??????????????????WeChatxxxxxxxx.exe????????????????2?PIPE?,??
???????
(?????????????????)???????????????????
??????????,?????????,??????????,?,?????,?????????????????????????????
(??)???
????3??????????,???????????????,2023?????????5????2?,??????????(95.179.XX.XX)??,?,??,?,????????????�?????????????�?�?�?�???????????????????????????�?�??(??+??)�?�???????IP??????????????????????�?�????????�?????????
(???)???????????
??????,???????????????????,2023?????????7?????26???????????????????????,?(65.21.XX.XX)???????????????????????????,?????????????????,???????,???????????????????????,???????1.03GB???????????????????????,??�?�?????�tip4XXXXXXXX.php�?
(?????)????????????????????????
????????????????,?????????,????????????,???????????????SSH?,????????,??
?????????????????????????
(?)??
??????????????,??????22??????8???????????????????????????,?10????????????????20??,?????,???????????????????
(???????)?
2023?5???2023?????????10????????????,??????30????,???????????????IP??????,???????
(?)?
?2?PIPE?�c:\windows\system32\�??,?????.net?????????????,?,????????????????????????KB,?????????????TLS?????????????????????????????????????,??????https???????????????????,?websocket+SSH?????????????????,???????????????
???????????????????????IP???????????????
??????
2024?12????18??????????????,?CNCERT????????????????????????????(
?????????????????
(???)????????
2024????????????8????19???????????,??,????????????/??????2024??????????????8??????21??????????,?????/??
(?)?
2024????8????21?12???????????????,???,??????,????????????????????????????????,?/xxx/xxxx?flag=syn_user_policy???????,?/xxx/xxxStats?
(??????????????)??????????
2024????????????11?????6????????2024?????????????11????????????????8??????????????????????2024?11????16??????????,????276???????????????????????
???????????????????
(?)?
?????????????????????IP??,?,???????????????????,????,???????????
(????)???
2024???????11???????6?????????11????????16?????????,????3?????IP?????????????????????????????????,???????????,???,????????????,?,?????4.98GB?
?????????????
(????????)??????????????
?,??????????????22?8?,????????10??????????????20??,??,??
(??????????????????????????)????????????????
???????5??IP??????????????,?,??
(????????????)????
?,????????????????????????????,??
???????,???????????,??????????????????
(???????????)????????????????????
??????????????,????,????,???????????????????276??,????????????????,????????????????????????????
????????????????????????IP???????????
?????:???????????????????????????????