?????

2024?????????????12???????????????????18?,???????????CNCERT?(

???????????

(????)???

??????Exchange????????????????2??????????Exchange??????????????,?,?,??

(?????)???????

????????????????????????,????2?,??????????,????????????????????,????/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,????????????????????????????????????,?,???????????????

(????????)??????????????30?

???????,???????,?,?SSH?SMB?30???????????????????????????;??,??????????????????????????????????????????????????????????????????????????,?websocket+SSH???,????????????????????,????WeChatxxxxxxxx.exe???????????????????????????2?PIPE?,??

???????

(?)?

????????????????????????,????,?????????,??????????????????????,??????,??

(?)????????????

?????????????3??????????,????,2023???????????????????????5???????????????2?????????????,???????????????????????(95.179.XX.XX)?,?????,?,????,???????“?”?“?????????”?“????”?“????(????????+?????????)”?“??IP?????”?“?”???????????????

(??????????)?????????????????

???????????,?????????????????,2023???????????????7???26???,?????????????????????(65.21.XX.XX)?,??????????????,???????????????????????????,????,???????????????1.03GB?????????,????“????”????????????????“tip4XXXXXXXX.php”?

(???)????????

????,???????????????????,??????????????????????,?????????????SSH??????????????,?????????,??

??????????????

(??)?????

???????,??????22?8?,?10????20?,???????????????,?????????????????

(???????????)??????

2023?????????????5??????????2023?????????????????10??????,????????30???????????????????????,?????IP????????,?????

(?)??

???????????????????????2??????PIPE?????????“c:\windows\system32\”??????????????????????????????????,??????????????????.net??????????????????????,?,???????????????KB,??TLS??????????????????????????????????,??????https??,?websocket+SSH??????,??

?????????????????????????????????????????IP?

?????

2024???12????????????18???????????,?????????CNCERT?????????????????????????????????(

???????????

(????????)?

2024?8??19?,?????,??????/???2024?8??????????????????21?,?/????????????????

(?????????????)?

2024????????????8??????????????21????????12??????????????,????????????????????,?????,?????????????????????,?????/xxx/xxxx?flag=syn_user_policy????????,?????/xxx/xxxStats?

(??????????????)??????????????????????????

2024???????????????????????????11????6??2024???????????????11????8??????2024?????11????????????????16??????????????,????????????????????????????276????????????????????????????????????????

???????????

(???????????????)???????????

?IP?,?,??????????,?,???????????????

(?????????)????????????

2024??????????11??6???11???16?,?3??????IP??????????,??,?????????????????,?????????,???????,???????????????????????????4.98GB?

????????????

(?????????????????)??????????????

????????????????,?????22???????????????????????????8???????????,?10??????????????????????20?????????????,?,??

(?)?

??5???????????IP??????????,??,????????????????????

(??)?????????????????????

???????????????????,??????????????????????????????????????????,?????????????????????????

??????????,???????????????????????????,????????????

(?)???

?,??,?,????????????276????????????,??????????????????,?????????????????

?????????????IP??????

???????:??

??

??:???????????,??????????,??????????????