?????????????????!???????????????

?????????????

2024?????????????????12?????????????????????????????????18????????????????????????????,?CNCERT?????(

?????????

(?)??????

?????????????????Exchange??????????2??????????????Exchange??????????,????????????,???????????????????????????,????

(?)?????????????

???????????,?2????????????????????????,?,???????????????,???????????/owa/auth/xxx/xx.aspx????????????????????????????/owa/auth/xxx/yy.aspx,?????????????????,?,??????????

(?)?30???????????

?????????????,?,??,?SSH?SMB?30?????????????????????;???,????????????????????????????,????websocket+SSH??,????????,????????????WeChatxxxxxxxx.exe????????2??????????????PIPE?,????????

?????????????

(?????)?????

???????,?????????????????????,?,??????????,???,??

(???????????)????????????????

??????3????????????????????????,????????????????,2023?????5????2?????,?????????(95.179.XX.XX)??,?,???????????????,???????????????,??????????????“???????????????”?“???”?“?”?“?(??????????????????????????????+??????????)”?“????????IP??”?“??????????????????????????????????”???????????????????????

(????????????)????

?????????,????????????????????,2023??????7??26????,????(65.21.XX.XX)??????????,?,?????????????????,??????????????????????,????????????1.03GB???????,?????????????????????“?”?“tip4XXXXXXXX.php”?

(?)???????????

??????????????????,?????????????????????,???,?????????????????????????????SSH????,?????,????????????????????

????????????????????????????????

(????)??

?,????????22??8??????,?10???????????????????????20???????,??????,??

(???????)?

2023??????????????5???????????????????????????2023???????10?,?30??,????????????????IP??????,??

(??????)???????????????????????????

????2?PIPE?????“c:\windows\system32\”???,??.net?????????????????,???????????,?KB,???????????????????TLS????????????????????????,??????????????????????????https?,????????????????websocket+SSH??????????????????????,???????????????

??????????????????????????IP??????

??

2024?12???????18??????????????,???????????????CNCERT??????????????(

???

(????????)????

2024????8?19?,?,????????????????/???????2024?8?21????,??????????????????/???????????

(?)?????????

2024??????????????????????????8????????????21????12??????????,??????????,????????????????????,???????,?/xxx/xxxx?flag=syn_user_policy??????,??????/xxx/xxxStats?

(???????????????????????)?

2024?11????6????????????????????2024?11???????????????????8?2024?11????????16???????,??????????????????????276??????????????

????????????????

(?)??

????????IP??????????,???????????????????,????????????????????,??????,??

(??????)??????????

2024???????????11??????????????6????????11???????16?,????????????????????????3????????????IP?,???????????????,??????????????,??????????????????????,??????????,??????????????????4.98GB?

????????????????????????

(?????????????)??

?,????22???????????????8?,?????10?????20??????????????,?????????,????????????????????????

(????????????????)?????????????

?5??????????IP??????????????,???????????????????,??

(?)?

???????????????????????,?????????????,?????????????

??????,?????????????,????????

(???????????????)??????????

??,?????????????,?????????,???????????????276??,?????????????,??????????????????????

??????IP????

???:???????????????