????????

2024?????12?18??????????????,????CNCERT???????(

??????????????

(???????)??????

?Exchange??????????????????????????????????????????2?Exchange?,?,?,???????????????

(?????)????????????

??????????,?????????????2?,???????????????????,????????,?/owa/auth/xxx/xx.aspx??????????????????/owa/auth/xxx/yy.aspx,????????????????????????????????????????????????????,?,???????

(?)??????????30????

????????????????????,?,?????,????SSH?SMB?30????????????????????;?????????????,?????????????????????????????????????????????????????????????,??????????????websocket+SSH?,?????????????????,?????????????????????????????????WeChatxxxxxxxx.exe???????????2???????????PIPE????????????????,??????????????????????

????????????????????????????????????????????????

(???????????????????)??????

???????????,???????????????????,????,???????????,?????,??????????

(??????????????????)?

??????????????3????,???,2023??5?????2??,??????(95.179.XX.XX)???????????????,?,?,??????????????,?“???????????”?“??????????????????????”?“???????”?“?????????(?+?????)”?“??IP???”?“?”??????????

(??)?????????????????????

???????????,??????,2023????7??????????26??????,??????????????(65.21.XX.XX)??????,??????,?,???,???????1.03GB?????,????????“?”???????????????????“tip4XXXXXXXX.php”?

(???????)???????????????????

???????????,?,???????,??????????????????????????????????????????SSH?,?,??

???????????????????????????

(?????????)???????????????

???,????????22??????8??????????????,????????????10????????20??????????????????????,?????????,??

(?)??????

2023????????????5??????????2023???????????????????10????,?30??????????????,??IP??????,??????????????

(?)?????

?????2??????????????PIPE??????“c:\windows\system32\”?????,??????.net?,???????????????????,?????????????????KB,???TLS?????????????????????????????????????????????????,????https??????????,?websocket+SSH??????????????????????,???

????????????IP???????????

??????????????

2024??????????12?18???????,???????????CNCERT???????(

???????

(???)????????????????

2024??????????8?19?????????,??????????????????,?/????????????2024??????8?21????,??????????/??

(?)?????????????

2024???????????????8?????????????????21??????????12??,??????????????????????????????,?,?????????????????,???/xxx/xxxx?flag=syn_user_policy???????????????,??/xxx/xxxStats?

(?????????)???????????????

2024?11???6??2024?????????????????11????????????????8?????2024?11?????????16????????????????????????,???????????276??????????????????????????????????????????????????????

???????????????????????????????

(?????)?

??????????????????????IP????????????????,?,????,???????????????,?????

(?????????????????)?????????????

2024????11????????????????????????6????11???????16?????????????,?3?IP?,?,???????????????????????????,????????????,?????????,?????????????????4.98GB?

???????????????????????????????

(??)?????

??,??????????????22?8??????????,?????10??????20???????????????????,??????????????????????????????????,??

(???????????????????????????)????????

????????5?IP??,?,??

(??)?

?,?????????,???????

??,????????????????????,?????

(?)?

????,????,???????????????,??????????????276??????????????????????????,????????????????????,?????

???IP????????????????

?????????????:??

??

??:???????????,??????????,??????????????