???????????????!?????????????????

?

2024??12????????????????????????18?,????CNCERT?(

??????????????????????

(??????????)???????????????

???????Exchange??????????????????????2???Exchange?????,??,??????????,??

(?????????????????)??????????

?,???2????????????,?,????????????????????????????????????,???????????/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,???????????????????,????,???????????

(?????)????????????30???????????

?,???,?,???????????????????????SSH?SMB??????????????30?????????????????????????????????????????????;?,????????????????????????????????,?????websocket+SSH?,??????????????????????????????????,???????WeChatxxxxxxxx.exe??2???PIPE????????????,??

???????????

(???????)?

?,?????????????????????????????,????????????????????????,?,?????????????,?????

(????????????)?

???????????????3???????,???,2023??5?????????????2??,?(95.179.XX.XX)??,??????????????????????,????,?????,????????????????“????????”?“??????”?“???????”?“?????????????(?+?)”?“??????????IP?”?“?????????”??

(??????)?

??????????????,????????????????????,2023????7???????????????????????????26??????,?????????(65.21.XX.XX)?,???????????????????????????,??????????,?????????????,??????????????1.03GB????,????“??”??????????“tip4XXXXXXXX.php”?

(?????????????)??

??,???????????????????,???????????????,????????????????SSH?????????,?,??????????????????????????????????

?????

(???????)????

??????,?????22?????????8??????????????????????,???????????????10?20?,???????????????????????,?????????????????

(??)???????????

2023???????????????????5?????2023?????????10?????????,?????30?,?IP?????????,????????????

(??????????????)??????

???????????2??????????PIPE?“c:\windows\system32\”?,??.net?,???,?KB,???????????????????????TLS???????????????????????????????????????,???????????????https???????,??????websocket+SSH????,??

???IP??????????????

????

2024????12?????????18???????????????????????????,???????????????????CNCERT?(

?????????????????????????????

(?)??????

2024???????????????8???????????19?,????,???????????????/?????????????2024????????????????8?????????????????????21??????,????????????????????/?????????

(??????????????????)??????????

2024?8?21?????????12??????????????????,?????????,???,???,?/xxx/xxxx?flag=syn_user_policy???????????????,???????/xxx/xxxStats?

(???????????????????)?????

2024?11????????????6?????2024?????11?8?????2024??11?16?,??276?????????????????????????????????????????????????????????????????????????????????????????????

????????????????????????

(???????????)?

???????????????????IP????????????????,????????,?,?????????????,?????????

(??)????????

2024??????????11??????6?11?????16??????,????????3?IP??????,????????????????????????????,??,?????????????????????????,???????????????,????????????????????????????????????????4.98GB?

????????????????????????????????????

(????????????????????????)?

????????????????????,????????22??????????????????????8?,?????10??????20?,??,???

(????)?????????????????

?????????????????5??????IP?,???????????,???????????????

(????)????????????

???,????????????????,???????????????????????????

????,?,??

(????)??????

?,????,???????????????,????276?????????,????????????????????????????,??????????????????????????????????

??????IP????