????

2024?12??18?,???CNCERT??(

????????

(?)??

???????????Exchange????????????????????2??Exchange????????????????,??????????????,?????????,????????????????

(?)?????????????????????

????????????,????????????????????2???????????,??,????????????????????,?????????????/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,??????,?,???????

(?????????????)?30????????????

???????????????,???,??????????????,???????SSH?SMB??????30???????????????????????????????????????;??????????????????????,??????????????????????????????????????????????????????????????????,????????websocket+SSH??????????????????????????????,???????????????,??WeChatxxxxxxxx.exe????2?????????????PIPE????,??

????????????????????????

(?)???????

?,?????????????????????????,?????????????????,???????????????,???????????????????,??

(???)?????

?3??,????????????????????????????????????????????,2023??????????????5??????????????2?????????,??????(95.179.XX.XX)????????,?,?,???????????????????????,??????????“?????”?“??”?“??”?“??????????(??????????????+???????????????)”?“?IP??”?“????????????????????????”????????

(?)????

????????????????,?????????????????????,2023????????7????????????????????????????26??,??????(65.21.XX.XX)???????????,????,?,????????,???????????????????1.03GB???,????????“???”???????????????????“tip4XXXXXXXX.php”?

(??)?

?,?,?????????????????,??????????????????????SSH????????????,?,?????????

??????????????????????????

(???????????????)?

?,?????????????????22??8??????,?10?20??,????,?????

(???????????)?????????????????????

2023?5????2023??????????????10?????,???????????????????30?,?IP?????????????,?????????????????????????

(?)?

????????2?PIPE???“c:\windows\system32\”?????????????,??????????.net?,?,?KB,????TLS??????????????????????????????????,???????????????????https???????,??????websocket+SSH??????????????????????,??

???????????????????IP??????

?

2024????????????12??????????????????????18???????????,?CNCERT?(

??????????????????????

(????????????????)?????

2024??8???????????????????????????19?????,???,???????????????/?????2024?????8?????????21??????????,????/?????

(??????????)?

2024??????8???????????21??12??????????,??????????????????????????????????,???????????????,????????????????????????????,?/xxx/xxxx?flag=syn_user_policy????????????,???????????????????????????/xxx/xxxStats?

(???????????)????

2024?11??????????????6???????????????????????2024??????????????????????????11??????8???2024??11??????????????????????????16?,?276????????????????????????????????

?????????????????????????????

(?????)?????

?IP????,?,??????,???????,?????

(?????????????????)?

2024????11?6???????11????????????16?,?3??????????????IP???????????????,?,???????????????????????,?????????????????????,?,???????????????????????????4.98GB?

??????????????

(????????????????)?

??????????????????????????????????,????22???8???????,??????????10???????20???????????????????????????,?????????,?????????

(?????????)???????????

???????????5?IP????????????,?????????????,???????????????

(????????????????????????)???????

?????,?????????????????????,???????????

??????????????????,?????,??

(????????????????)??????

???????,??????,?,?????276?,????????????,????????????????

??????IP?

??:?????????

??

??:???????????,??????????,??????????????