????:1?????:??????

2???????

3???????

4?????????

5?????SPA??

???????

2024????12?18??????????????,?????????????CNCERT???????????(

????????????????????????????????????

(?)?

??????????????Exchange???????2?Exchange????????,?????????,????????????????,??????

(??)???????????

??????,??????????????????????????????2?????????,??,?????????,???????/owa/auth/xxx/xx.aspx????????????????/owa/auth/xxx/yy.aspx,???????????????????????????????,?,????????????????

(?????????????????????????????????)?30???????????????

?????????,?????,?,??SSH?SMB????????????????????????????30?????????????????;????,???????????????????????????????????????????????????????????????????????????????????????????,????????????????????????websocket+SSH?????????,???????????????????????,?????????WeChatxxxxxxxx.exe??2??????????PIPE????????????????,??

????????????????????????

(?????????)???????????????????

??,????????????????,????,???,???????????????????????????,??

(????????)?

??????????3????????????,?????????????????????????,2023???????????????5???????2??????????????????????????,??????????????(95.179.XX.XX)???????????,??????????????????????,?????,?????,????“???????????????????????????”?“?”?“???????????”?“?(????+?????)”?“?IP??”?“????????????????????????????”?????????

(???????????????????????????)????

????????????????????,?????,2023????7????????????????26???????????????????,????????????????????????(65.21.XX.XX)??,??????????????????????????????????,??,??,?????1.03GB?????,?“????”?“tip4XXXXXXXX.php”?

(??)??

??,???????????,???????,?????????????????SSH?????????????,??????????????????,????????

??????

(?)?

????,?????22??????8?????????,????????10?20?????????,????,????????????????????

(??????????)?

2023??????????????5?2023?10?,?30???????,??IP???????????????????????,????

(????????)?

?????2?PIPE????“c:\windows\system32\”?,?.net??????????????,???????????????,???KB,?????????????TLS?????????????????????????????????????????????????????,???????????????????https??,?websocket+SSH??????????,???????????

?????????????IP???????

????????????????????

2024??????12?18???????????????????,?????CNCERT??(

????????

(???????????)??????

2024???????????????????????????8?????????????????19???????????,?,?/??2024????8????????????21??????,????/????

(????)????

2024?8?????21?12????????,?????????????????,?,???????????????????,??????/xxx/xxxx?flag=syn_user_policy?????,??????????/xxx/xxxStats?

(????????????????)????????????

2024?????????????11??????????6????????????????????????2024?11???????????????8???????2024??????????11?????16??????,?????????????????276????????????????????????????????????????

??????????

(?)??????

????????????IP??????????????????,???????????????,??????????,??,?????

(?????????????????????)?

2024??????????????11???????????????6?????11?16??????????????????????,??3?IP??????,?,?,????????????????????,?,???????????????????4.98GB?

????????????????

(???????????????????????)??

??????????????,?22?8?????????????????,???10????20??????,??????????,?????

(?)??????????????

?5?IP?,??,??

(???????????)????

???????????????????????,????????????????????????,??????

?,?,?????????

(??????)??????????????

???????????,????,?,?276???????????????,?????????????????????????,????

??????????????????????????????IP??????

???????????????????????????:?????????