???????????????!?????????????????

????:????????????:????vx

??????????

2024????????????12????????????18?????????,????CNCERT???????(

????????????

(?)?

?Exchange???2?Exchange???,?,???????????,???

(????????????????????????????)?????????????????????

????????,??????????????2???????????????????????,???,???????????,????/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,?????????????????????????????,?????,????????????????

(????????????????)???????????30???????

?,????????????????,????,?????SSH?SMB??????????????????????????30???????????????????????;??????,?????????????????????????????????,????websocket+SSH????????????,?????????????????????????,?????????WeChatxxxxxxxx.exe???????2?PIPE??,?????

???????????

(????)???????

?????,???,?????????,????????,??,??

(???)??

?????????????????3????,??????????????,2023???????????????????5???2?????,?????????(95.179.XX.XX)??????????,?,?,?,???????????????????????“???”?“??????????”?“??????????”?“??????(??????????????????+??????????????????)”?“??IP????????????????”?“???”???????

(?????????????)??????

????????????????????,???????????????,2023???????????7?????????????????26?,????????????????????(65.21.XX.XX)??????????????????????,?????????????,???????????????????????????,?,??????????????????1.03GB?????,?“?”????????????“tip4XXXXXXXX.php”?

(???????????)?

?,?,??????????????????????,??????????????????????????????SSH?????,?????????,???????????

???????

(??)???????????????

????,???????????????22?????????????????8??????????????,?????10????????????????????????20??????????????,??????????????,???????

(?????)?????????????????

2023????????????????5?2023??10???????????????????,?30???????????????????????????,?IP?,??????????

(?)?

?2???????????PIPE??????????????????????????????????“c:\windows\system32\”?,????????????.net?,??,???????????????????KB,?????TLS?????????????????????????????????????,????????https?,????websocket+SSH????,????????????????????????????

?????????IP???????????????

??????

2024?????????????????????????????????12??????????????18?,????CNCERT?(

??????

(????????????????????????)?????????????

2024??????????8?19????,?,????????/??2024??????????????8????????21???????????,?????????????/?????????????

(???????????????????????)?????

2024?????8??????21????????????????????????12????,?????????,??????????,????????????????,????/xxx/xxxx?flag=syn_user_policy?????????????????????????????,?????????????????????/xxx/xxxStats?

(??????????????????????)?

2024??????????11??????????????6?????????????????????2024????????11???????????????????8???????2024???????????????????11??16??????????????,??????????276?????????????????????????

????

(?)???????????????????????

?IP???????,?,?,??????,?????

(???????????????)????????????????

2024??11??????????????6????????11????????????16?????????????????,??????????????3??????????????????????????????IP???,?,??,??????????,?,???????????????4.98GB?

????????????????

(???????????????)????

????,???????????????22??????8?????????????,?10???????????20??????????,?,????????????????????

(?????)?

????5??????????????????????IP??????????,???????????,???

(????)?

??,??????????????????????,??

??,????,????????????????????????????

(????)?

?,??,???????,??????276??????,???,????

??????????????????????IP??????????????????????????

????????:??????????????