????:1?????????:????????

2???????????

3??????

4??????100???

5???????

??????????????????????????

2024?12??????18????????????????????????,???CNCERT????????????????(

????????????????????

(??????????????)??????????????????????

????????????????????????Exchange????????????????????2?Exchange??,??????,???????????,???????

(????)??

??????????????????????,?2?????,?,???????????????,???????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????,?,????????

(????????????????????????)????????30?

??????????????????,??????????????,??????????,?SSH?SMB?30?????????????????????;??????????????,??????????????????????????,???????????websocket+SSH???????,???????,??????????????WeChatxxxxxxxx.exe????????????????2?????????????PIPE?????????????,?????

????????????????????????

(???????????????????)?

???????????,??????,???????????????,???,?,??

(??????????)???????????????

????3??????????????,??????,2023???5??????????2?????,?????????(95.179.XX.XX)?,?????????,???????????,?,??????????“????”?“??????????”?“?”?“?????(????+?)”?“?IP??”?“??????????”???????????

(??????)??????

???????????,?????????????????????????,2023??????????????7?26?????????,?????????(65.21.XX.XX)????,?????????????????,?????????????????,?,??????1.03GB??,??????????“??”??????“tip4XXXXXXXX.php”?

(?????)?????????

?????????,????????????????????????????,???????????????,?????????????????????????SSH????,?,??

???????????????????

(???)????????????????????????????

?????????????,?????22??????????????8???????????????????????,??????10????????????20?,?,????

(??????????)????

2023???5??2023?????????????????10?????????,???????????????30?????????,???????????????IP??,?????????????

(?????????????)?

????????????????????2?PIPE????????????????“c:\windows\system32\”?,?????.net?,??????????????????????,??????????????????????????????KB,????????????TLS?????????????????????????????????????????,??????????https?????????????,?websocket+SSH?,?????????????????

????????????????????????IP???????

??????????????

2024????12??????18?,?????CNCERT?(

????????????????

(?????)?

2024????????????8?????19???????????????????????,?,?????????????/??2024???????????????????????????8??????21??,?????????????????/???????????????????????????

(????????????)??????????????

2024????8??????????????21??12???????????????,???????????????,???,???????,???????????????????????/xxx/xxxx?flag=syn_user_policy??,???/xxx/xxxStats?

(?)??

2024?????????????????????11??????????6????????2024?11??????8???????????????2024??????????????????????????????????11????16?,???????????????276?????????????????????????????????

?????????????????????

(?????)?

????????????IP???????????,?????,???????????,????,??

(?)?

2024???????????????????????????11????????????????????6??????11????????16?????????????,??3?????????????????????????????????IP??,???????????????????????,???????,????????,?,???????????????????4.98GB?

???????????????????????

(??)??????????????

??????????????????,??????????????22??????8??????????????????,??????????10????20?,??,??

(?)???????????????????????????

????5????????????IP????????,?,?????????

(???????????)??

???????????????,????????????,????????????????????

?????,?,????????????????????

(?)?

??,??,????,????276?????????????????????,????????????????????????????????????,??????????

??????IP?????????

??:??