?????

2024??????12?18???????,???????CNCERT??????????????(

????????

(??????????)???????????????????????????

???????????Exchange???????????????????2??????????Exchange??,?,??,???????

(?)????????????????

???????????,??????????2?????,????,??????????????????????????????????????,??/owa/auth/xxx/xx.aspx????????????/owa/auth/xxx/yy.aspx,?????????????????????????????????????,?,??

(??????)?30????????

??,??????????,??????,?SSH?SMB??????30??????????????????????????????;??,?????????????????????????????????????????????????????????????????????????????????,??websocket+SSH??,??????????????????????????????,???????????WeChatxxxxxxxx.exe???????????2????????????PIPE??????,???????????????????????????????????

?????????

(?)????????

?,??????????????????????????,??????????????????????,???????????????,?????????,????????????

(??????????????????????????)???????????

??????????????3???????????????,??????????,2023?????????????5??????????????2??????,??????????????????(95.179.XX.XX)????????????????????,?,???????????,?,?????????????“?”?“?”?“?”?“?????????????????(????+?????????????????)”?“?????????????????????IP?”?“?????”??????

(???)?

?????????????????????????,??????????????,2023???7??????26?????????????????????????????????,?(65.21.XX.XX)??????,???????????????,???????????????,?????????????????,???1.03GB??????????????,????“??”?“tip4XXXXXXXX.php”?

(??)??????

??,??????????????????????????,?????????,????????????????????????????SSH?,??????,?????????????????????????

???????

(????????????)?????

???????????????????????,?????22??????????????8????,????10????????????????20?,??,?????

(???????????????????????????)???????????

2023????5????????????????????????????2023?10?,?30??????????????????,???????????????????????IP?,??????

(???????????)?

????2??PIPE?????????????“c:\windows\system32\”???????,???.net???,???????????,??????????????????????????????KB,?????????TLS????????????????????????????,??https????,?websocket+SSH??????????????,??

???IP????

??

2024????12??18??,???????????????????CNCERT???????????????(

????????????

(????????????????????)????

2024?8??????????19?????????????,?????,????/??????????????2024????????????????8???????21??????????????????????,?/???????

(????)??????????

2024??????????8??????????21????????????????12?????????????????????,?????????????????????????????,?,???,?/xxx/xxxx?flag=syn_user_policy?????,?/xxx/xxxStats?

(????)??

2024?????????11?????6?????2024?11????????????8???????????????????2024?11????????16?,??????????276???????????????????????????????

??????

(???????????????????????????)???????

????????IP????????????,????????????????????????????,?????????,?,???????????????

(??????????????)??????????????

2024?11?6?11????????16?,?3????????????????IP?,?,?????????,?????????????,?,???????????????????4.98GB?

?????????????

(?)?????????

?,?22??????????????8?????????????,?10???????????????20????,????????????,?????????????????????????

(???????????????????????)?????

???????????????5??????IP?,????????????,???????????????

(?)???

????,???????????????????,????????????

?,?,????????????????????

(???????????????????????????)?

?????????,?,?????????????,?276???,???????????????????????,?????????????????

?????????????IP???????

???:??????????

??

??:???????????,??????????,??????????????