????:1???????????:??400?4???????

2????????

3??????????

4?????

5?ktv???????

?

2024?12???????????18????????????????,?CNCERT????????????(

????

(??????????)???????????????????

??????????????????????????????????Exchange??????????????????2?????????Exchange?,?????????????,?,???

(?)???????????????

?,??2?,?,????????????????????????????,???????/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,???????????????????????????????????,??????,??????????????????????

(??????????????????????????????)?30?

???????,??????????,???????????????,????????????SSH?SMB?????30????????????????????;????????,????????????????????????????????,????websocket+SSH???,???????,???WeChatxxxxxxxx.exe???????????????2??????????PIPE?,?????????????

????

(??????????????????????????)???????????????????

??????????????,??????????????????????????,?????????,????,??????,???????????

(?)???????????????????????????

?3??????????,?????????????????????????????,2023??????5?2????????????,???????????????????????(95.179.XX.XX)?????????,??????,????????????????????????,???????,?“???????”?“????”?“?”?“???????????????????(??+??)”?“?IP?”?“???????”?????????

(????)???????????????

??????????????????????????,?????????,2023?????7????????????????????????????26????????,??(65.21.XX.XX)????,?????,??????,??,???????1.03GB????????,???????????????????????????“?????????????”?“tip4XXXXXXXX.php”?

(??)?

?????????,??????,???????????,???????????????SSH?,??,?????????????????????

???????????????

(?)???????????????????????????

?????,??22????8?,?10?20?????????????????????????????????,?,???

(?????????????)??????

2023?????????5??????????????????2023?10????,?30??????,?IP??????????????????????,??????

(?)?

?????????????????????2???????????????PIPE??“c:\windows\system32\”??,???.net??????????,??????????????????,?KB,?TLS????????????????????????????????????????????????????????,????????????????https????,?websocket+SSH????????????????,???????

??????????????????????????????IP?????????????????

????

2024??????????????????????12?18?,??????CNCERT?(

??????????????????????

(???????????????)???????????????

2024?8???????????19?????,???????????,?/????????2024????????????????????????8???????????????????????21?????????????????,??????????????/???????

(??????????????????????)?

2024????????8????????????????????21???12???,??????,?,?????????????,??????????/xxx/xxxx?flag=syn_user_policy???????????????,?????????????/xxx/xxxStats?

(?)?????????????

2024?????11???????????6??2024??11??????????????8????2024?????????11????????????16????,????276?????????????????????????????????????????????????????

???????????

(?)???????

???????????IP??,???,????????,??????????????,??????????????????

(?)?

2024??????????11?6?11??????????????16?,?3????????IP?????,?????,????,???,????????????????,??????????????????????4.98GB?

???????????????

(?)?????

???????????????????,??????????????????22????????????????????????????8???????????????,??????????????10???????????20??????????????????????,???,??????????????????

(?????????)??????????????

?????????5???????????IP??????????,????????????,???????

(??????????)????

?,?????????,??

????????,??????????,????????????

(??)????????????????

??????????????,????,?,?????????????276??????????????,????????????????????????????,?????????

????????????????????IP??????????

??:???????????