?

2024??????????????????????????12???????????????18??,?CNCERT????(

?????????

(??)???????????

??????Exchange???2?Exchange?,??????????????,??????,??

(??????????????)?

?????????????,?2????????,????????????????,????????????,?????????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????,????????????,???

(??????????)?30??

?????????,?,????,??SSH?SMB????????????30????????????????????????????????????????????????????;??,?????????????????????????????????????????????,?websocket+SSH?,???????????????,?WeChatxxxxxxxx.exe???????????????2??PIPE???,?????

????????????????

(??????????????)??????

?,????????????????????????????????????????,??????,?,??????,???????

(??)????????

???????????????3????????????,???????,2023?5????2??,?(95.179.XX.XX)?,????????,??????,????????,????????“???”?“????????”?“????????????????????????”?“?????????????(???????????+?)”?“??????????????IP?????????”?“?”?????

(????)????

???????????????????????,???????????????????????????????????????????????,2023??????????7?26???????????????????????,????????(65.21.XX.XX)???????????????????,?,?????????????????????????????????,????,?????????????????1.03GB??,?“??????????????????????”?“tip4XXXXXXXX.php”?

(??)?

???????,????,?????????????????????,???????????????????????????SSH??????????????,???????????,??

???????????????????

(???????????)??????

???????????????,?22?8??????,????????????????????????10?20?????????????,?,???

(????????????????????)????

2023???????5????2023????????????10?,???30?????????????,?????????????????IP????????,?????????????????

(????????????????????????????)?????

?????2????PIPE????????????????“c:\windows\system32\”??????????????,????????????.net??????????,???????????????????,?????KB,??????????????TLS???????????????,???????????????????https?,?websocket+SSH????,??????????????

????????IP??

????????

2024?12???????????18????,????????????????????????????CNCERT??????(

??????????????????????????

(?)?????????????????

2024?8???19??,???,???????????/????????2024???????8??????????21?,?/??????????

(?????????)??????????????

2024??8???????????21?12???????????????,??????????????????????????????????????????????,????????????,????????????????,?????????/xxx/xxxx?flag=syn_user_policy???????????,??????????/xxx/xxxStats?

(???????????)???

2024?11??????6?????2024?11??8?????2024??????????????????11????16?????,?????276??????????????????????????????????????????????????

????????????????????????

(???)???????????????????????

???????????????????????????IP??????????,??,??????????,??????????????????,????????????????

(?????)???????

2024??????????11????????????6???????????????????????11??????16???????????????????,??????????????????3?IP???????????????????,?,??????????????,???????????,?,??????????????????????????????????4.98GB?

??????????????????

(?)?

???????????,?22?8????????????????,??????????????????????????10?????????20???????????????,????,??

(????)???????????????????????????

???5???IP?,??????????????,??????????

(??)???????????????????

???????????????,?????????????????,????????

?,?????????,??

(???????)?????????????????????

??,??????????,??????????,?276???????,???????????????????????,?????????????

??????IP??????????????????????????????

??????????????:????????

??

??:???????????,??????????,??????????????