???????????????!?????????????????

?

2024??????12??????18??????????????,?????CNCERT??(

??????

(???????????????)?????????????????

???????????Exchange????????????????????????????2????????????????????????????Exchange??????????,???????,???????????,??????????????????????????????????

(??????????????)??????????????

??????,???2???????,???????????????????,????????????????????????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????????????????????????????????????????,??????????????,????????????????

(?????????)??????30???

?,?????,?????????????????????,?????????????SSH?SMB??????????????30??????????????????????????;?????,??????????????????????????????????????????????????????????????????????????,????websocket+SSH????,???????????????????,????WeChatxxxxxxxx.exe???????2???????PIPE???????????,??

?????????????????

(?????)??????????

???????????,????????????????????,?,?,?,??

(????????????????????????)??

?3???????,??????????????????????????,2023?5?????2?,??????(95.179.XX.XX)?,?,??,?????????,??????????????????????“????”?“?????”?“????????”?“????????????????(????+?)”?“?IP?”?“???”??????????????????

(????)???????????

??????????????????????????????,????????????????????,2023?7?26????????????????,?(65.21.XX.XX)???,????,????????????,????,??????1.03GB????????????????,??????????????????????“???????????????????????”?“tip4XXXXXXXX.php”?

(??????????)?

??,?,??????,???????????????????SSH??,???????????????????????,??

????????????????????

(??????????????)??????????????

???????????????????????????,?22?????????????8????????,?????????10???????????????????20??????????,?,???????????????????????????????

(?????)?

2023???????????????????????????5??????????2023??????????????10??,?????????????30?,??????????????????????IP???????????????,???????????

(??????)????

??2?PIPE?????“c:\windows\system32\”????,??????????????????.net?????????,???????????????????????,??????????????????????????KB,??????????TLS???????????????????????????????????????????????,?https??,?websocket+SSH??????????????????,?????????

????????????IP????????

??????????????

2024???????????????????12????18??????????,??????CNCERT????(

??????

(???????????????????????????)???

2024?8??????19????????????????,????????,??/????????2024???????????????????8?21????????????,??/??

(?????????????)??

2024????8?21????12?,?????????,????,??????????????,????/xxx/xxxx?flag=syn_user_policy????????????,??????????/xxx/xxxStats?

(??????????????????????)????

2024?11?????6???????????????2024??11?????8????????????????????2024?????????11?????????????16???????????????,?276??????????????????????????????????????????????

????????????????????????????

(???????????????????)?

?????????????????????IP?,?????????????,??????????,??????????,??

(?)???????

2024?11?6?11?????????????????16??????????,?3???IP???,?,??????????????????????????????????,????????,?????????,????????????????????????????????????????4.98GB?

??????????????????????

(????????????????)?

?,????????22?8?????????,?10?20????,????????,????????????????????

(???)????????????

?????5?????????????IP????????????????????????,?,???????

(????????)?

??,?????????,??

?????,???????????,?????????????????

(???)?????

?,????,?,??276??????,???????????,?????

???????????????IP?????