????:1???????:??????????

2??????VX

3?????????????

4?????398

5???????

???????

2024?12????18????????????,?CNCERT??(

???

(?)??????????

??????Exchange??????????????????????????????2?Exchange????,??????????,??????????,???????

(?)???

???????,????????2??????????????????????????,????,????????,??????????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????,?????,????????????????????????

(????)?30????

?????,??????????????????????????????????,?,????????????????SSH?SMB?30???????????????????;????????????,??????????????????????,??websocket+SSH?????,???????????????,????WeChatxxxxxxxx.exe?????2?PIPE????,?????????

???????????????????????????????????????

(??)?

??????????????????????,????????????????,?,???????????????????,?????????,??

(??????????????)???

?????????????????3????,???,2023???????????5?2??????????,??????????????????????????(95.179.XX.XX)??,?????,??????????,???????????????,??“????????????”?“????????”?“??????????????”?“???????????????????????????(???????????+??????????)”?“?IP?????”?“???????????????”???

(??????????????)?

???????????????????????,?????????????????????,2023???????????????7??26?????,????????(65.21.XX.XX)???,???????????????????,?????????????????,?,????????1.03GB???,?“???”???????????????“tip4XXXXXXXX.php”?

(??????)??????????????????????

?????????????,???????????????????,???????????????????????????,?????????????????????????????SSH?????,????,??

????????????????

(?)??????

?,??????22???8??????????,?????????10?????????20????????,???????????????????????,?????????

(??????????????)????

2023???5?2023?????????10???????????????,????????????????????30??????,??IP?????,??????????????

(?)???????

??????????????????????????????2?PIPE????????????????“c:\windows\system32\”???????????????????????,?.net??????,????,?KB,?????????TLS??????????????????????????????????????????????,?????????https??????,?????websocket+SSH?????????????????????????????????,???

???????????????????IP??????????

???????????

2024???????????12??????18???????????,?????????????CNCERT?(

??????

(??)?

2024??8????????19?,???,???????????????????????????/?????????????????????????2024?8????21?????????,??????????????/??????????????

(?)???????????????

2024?????????????8??????????21??12?,??????,???????????????????,????????????,?/xxx/xxxx?flag=syn_user_policy??????,??????/xxx/xxxStats?

(??????????????)????????????????????????

2024?????????????????11???????????????6????????2024????11?8?2024?????????11???????????????16?,??????????276????????????????????????????????????????

?????????

(?????)????

??????IP?,?,?????,????????????????????,??

(????????????????)?

2024????11?6??????????11???16???????,??????3???????????IP?,???????????,????,?????????????????,????????????????,????????????4.98GB?

??????????????????????????????

(?)?????????

??????????,??????????????????????22???????8????????????????????????????,??????????????????????10??20??,?????????????????????,??

(??????????????)?

???????5?IP?????????????,?????????,??????

(????)????

??????????????,????????????????????????????????????????,?????????????

???????,??,??????????????????????

(?)?

?,?????????????????,??????,???????????276???????????,??????????????????????????????????,????????????????????????????????????????????

?????????????IP??

???????????????????:??????