???????????

2024??????????????????????????12?18??????????????????????,???????????????????CNCERT????????????(

???????????????????????????????????????????

(???????????)???????????????

????????????Exchange????????????????2?Exchange????,?????????????????,?,??

(?)?

????????????,???????????2??????????????,??????????,???????,???????????????????????????/owa/auth/xxx/xx.aspx?????????????????????/owa/auth/xxx/yy.aspx,???????????????????????????,?????????????,??????????????

(????????????????)?30??????

??????????????????,?,?????????,??????????SSH?SMB?????????????30??????????????????????????????????????????????;??????,??????????????????????????????????????????????????????????,?websocket+SSH???????????,??????????????????????????????????????,?WeChatxxxxxxxx.exe??????2?PIPE??????????,???????????

???????????????????????????????????????

(??????????????????????)???????????

??,?????????,???,???????????????????????????,?????????,???

(?)??????

??3?,????????????????????????????,2023?5?????????2????????????,?(95.179.XX.XX)???????????????????,??,??,?????????????,?“??”?“????”?“??????”?“????(????????+??????????????)”?“?IP?”?“????”???????????????

(???)?

???,???????????????,2023???????7??26?,????????????????(65.21.XX.XX)???????????????????,??????,???????,?,?1.03GB???????????????????????????????????,??????????????“????”?“tip4XXXXXXXX.php”?

(?????????)?????

????,??????,???????,?????????SSH?????,?,???????????????

???????????

(???)?????????????????????????????????

??????????????????????????????,?22????????????????8?,?10?20?,?????????,????????????????????

(??????????????)????

2023?5???????2023???????10????????,???????????????????30???????????,?IP????????,?????

(??????????)?????????????????

?2????????????PIPE???????????“c:\windows\system32\”?????,???.net????????????,?????,?KB,???????????????TLS????????????????????????????????????????,???????????????????https?,?websocket+SSH??????,???????????????????

???????IP???

????

2024??12?18?????????????????????,??????????CNCERT??(

????????????????????????????????????????????????????

(?)?

2024??????8??????19???????????????,??????????????,?/??2024?8???????????????21?,???????????????/????????

(?)?

2024??????????????????8???????????????????????21?12????????,??????????????,??????????,?????????,?????????/xxx/xxxx?flag=syn_user_policy?????????????,?????/xxx/xxxStats?

(??????????????)????

2024?11????????6?????????2024?????11???????8???????????????????????????2024??????11???????????????16??,????276?????????????????????????????????

?????????

(????)????

?IP?,?,?????????,?,??

(????)????????????????????

2024???????11????6?????????????11??????????????16????????,?3???????????IP??,??????????????????????,??????????,????????????????????????????????????????,???,??????????????4.98GB?

???

(??)?????????????????

??,??????????????????????22??????8?,??????????10??20???????????????????????,?,??

(?????????)??????????

?????????????????5????????IP?,??????????????,???

(????????????????????)???????????

??????,????????????????,????????????????????????????

??,?????????????,?????

(?????)?

?,?,????,????276??????????,???????????????????????,??????????????????????????????

????????????IP??????????????

???????????:??

??

??:???????????,??????????,??????????????