?????????????????!???????????????

??

?????

2024?12????18?????????????,????CNCERT???????????(

????????????????????????????????

(??????)?????????????????

??Exchange??????????????????????????????????2?Exchange?,?????????,????????????????????????,???????????

(??????????????)?

???????????,?2??????????????,???????????,??????????????????,????????????/owa/auth/xxx/xx.aspx??????????/owa/auth/xxx/yy.aspx,??????????????????????????????????????????,?,??????

(????)???????????????????30???

??????????????,???????????????????????????,?????,?????SSH?SMB??????????????????????30???????????????????????????????????????????;??,????????????????????????????????????????????????,????websocket+SSH?,?????????????????????????????,???????????????????????????WeChatxxxxxxxx.exe???????????????????????2????????????????????????????PIPE?,????????????

??????????????????????????????????

(????)??????????

?,????????,?????????,?,???,??????

(???????????)?

????3?,??????,2023??????????5?????????????2????????????,???(95.179.XX.XX)?,?????,?????????????????????,?,??“?”?“?????????????????”?“??????”?“?????????????(????+??????)”?“?IP?????????????”?“???????????”??

(?????????)??????

????????????????,???,2023??????????????????????????????7???????????????26????,?(65.21.XX.XX)?????????,?????????????????,???????????????????,????????????????????????,??????1.03GB????????,?“???????”???????????????????“tip4XXXXXXXX.php”?

(????????????)????????

???????,????????????????,?,???????????????????SSH??,??????????????????,???????????

???

(?????????????????????)?????

???????????????????????,????????????????22?8?,?????????10?????20?,???,???

(???????????????)???????????????????????

2023?5?2023??10?,?30??????????,?IP???????,??

(???????)?

??????2??????PIPE??????“c:\windows\system32\”?,???.net??????????????,?,??KB,??TLS???????????????????????????,?https????,???????????websocket+SSH???????????????????????,??

??????????????????IP??????

??????????????

2024??12??????18????????,?CNCERT??????(

????????????

(?)?????

2024?????????????8????????????19??????????,?????????,?/??2024????8????21???????????????,??????????????/????????????

(???????????)???????????????

2024?????????????????8????21?????12????,???????????????????,????,?????????????????????,????/xxx/xxxx?flag=syn_user_policy???,??????????????/xxx/xxxStats?

(????)??????

2024??11???????6??2024????11????????8????????????????????2024?????11???16????,??????276??????????????????????????????????????????????????????????????????????????????

?????

(?????????)??????

????IP??,?????????????,?,????????????????,?????????????

(?????????)???

2024??????????11??????????6??11??16??,??3????????????????????????????IP??????????,?,?,????????????????????????,?????????????,?????????????????????????????????????????4.98GB?

???

(???????????????????)??????????????????????????

?????????,????22??????8??????????????????????,????????10??????????20?,????,???????????????

(????)???????

??????????????????????????5??IP??????????,?,??

(????????)???????????????????

????????,????????????????????????????????????????,?????????

???????,????,??

(???????)??????????????????????

??????????????????,?,?,???????????????276??????????????,??????????????????????,????

???IP?

??????????:???????????????

?????????

??????????????????????!????????????????????

????????