????:1??????????????:?????????

2??????

3???????????

4???????????

5?????????

???????????????????????

2024????????????12???????????18?,???????????????????CNCERT??(

???

(???????)?????????????????

?Exchange????????????????????2??????Exchange??????????????????????????????????,??????????????,??,???????????????

(?)?

??????????,???2?????????????????????????????????,????,??????????,?/owa/auth/xxx/xx.aspx?????/owa/auth/xxx/yy.aspx,???????????????????????????????,????????????,??

(???????????????????)?????30???????????

???????????,???,????,????SSH?SMB???????30???????????????;????????????,????????????????????????????????????????????????????????????????????????????????????????,?????websocket+SSH?,???????????????,??????????????????????WeChatxxxxxxxx.exe???????2??????????PIPE????,???

?????????????????

(??????????????)??

?,????????????????????????????????,??????,?,????????????????,???????????????????????

(????)????????????????????????

?3?????,????????????????????????????,2023????????????????????5????2???,???????????????????????(95.179.XX.XX)???????,????,??????????????,???????,???“?”?“??????”?“??????”?“?????????(??????????+?)”?“?IP?????”?“??”??

(?????????????)?

??????,????????????,2023??7???????????????????26?,??????????(65.21.XX.XX)??????,???,???????????????????,???????????????,?1.03GB?????,??????“?????”?“tip4XXXXXXXX.php”?

(??????????)???????????????????

?,???????????????????????,??,??????SSH???????,????????????????????????????,??

????

(????????????????????????????)?

?,???????????22???????????????????8??????,???????????????????????????10?20?????????????,??????,??????????

(??)????

2023?????????????5??????????2023??10????????????????????????,????????30?,??IP?,????????

(?)?

?2?????????PIPE?“c:\windows\system32\”???????????????,??.net??????,????,?KB,???????????????????????????TLS????????????????????,???????????????https??????,???????????????????????websocket+SSH?,??????

?????????????????????????IP????

?????????

2024??????????????????12??????18??,???????CNCERT??????????(

???????

(?)????????????????????????

2024?????????8?????????19?????,???????????????,?????/????2024?????????????????????8????21??????,?????????????/??

(??????????)??

2024??8?21???????????12??????????,???????????,?,???????,???????????/xxx/xxxx?flag=syn_user_policy??,????????/xxx/xxxStats?

(??????????????)?

2024????11??????????????6????????????2024?11?8????????????2024???????11????????16???,????????????????276?????????????????????????????????????????????????????????

???????????????????

(?)?

??????????IP?,???????????????,???,??????,??

(??)?

2024????????11????????6????11?16??????????,????????????3???????????IP?????????,?,???????????????,??????????,?,????????????????????????????????????4.98GB?

????????????????????????????????????????

(?????????????)?????

???????????,?22????????????????8????,?10?????????????20????,????????,???????????????????????????

(?)??????????????????????????

?5?IP???????????,?????????????????,??????????

(?????????????????)??????????????

??????????????,???????????????????,???????????

?,????,??????

(???????)???????????????

???????????????????,??????????,???????????????????????????,???????????????276?????????,????????????????????????,????

??????????????????????????????????????????IP?

?????????:??????