????:1???????wx:???????????

2??????????

3?????????????

4????????

5?soul???????????

?????1????17????????? ??????17?,??????????

????

2024??????????12???????????????????????????18????,?????????????????CNCERT????????????(

??????

(??????????)???????????????????????????

2024????????????8????19???????????????,??????????????????????????,??/???2024??????????????8??21????????????????????,??/??????????????????

(?????)?????

2024??????????????8????21?12???????????????????????,???,????,???????????????,?/xxx/xxxx?flag=syn_user_policy??????????????,???/xxx/xxxStats?

(?????????????)???????????????

2024??????????????11????6????????2024???????????11??8?????????2024?????????11???????????16?????,?????????????276????????????????????????????????????????????????

????

(??????????????????)?

???IP????????????????,?????,??????????,?,???????????????

(????)????

2024?11????????6?11??????????16?,??????????3??IP?????????????,?????????????????????,?,?????????,????????????,????????????????????????????????????????4.98GB?

????????????????

(???????)???????????

??????,???????????????????????22?8???????????????????,????10??????20???,??????????????,??

(??????????)??

????????????????????????5?????????????????????IP??????????,???????????????????????,??

(??)?

?,?????,???????

???????????????,??????????????????,???????????????

(??????)????

???????,??,????????????????,???????????????276???????????????,???????????,????????????

???????????????????????????IP?

?????

2024????12?18???????????????,?????CNCERT?(

????????????????????????

(?????????????)???

???????Exchange????????????????2??????????????Exchange?,?,?,???????????????????????????????????

(?????????)?

??????,??????????2?,????????,?????????????,?/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,????????????????????,????????,??????????

(??????????????????????????????)???????????????????30????????????

???????????????????,??????????????????????,?,???????????SSH?SMB?30????????????????????????????;???????????,?????????????????????????????????????????????????????????????????????????????????????????????????????,???????websocket+SSH???,????,??????WeChatxxxxxxxx.exe????2????PIPE???????????????????????????,???

?????

(???????????????????????)??????????

?????????????,??????????,????,??,??,????????????

(????????????????????????)??????

??????????????????????????3?,??????????????,2023??????????????????5????????2?,??(95.179.XX.XX)??,?????,????????,?????,?“?”?“????????????”?“???????????”?“?(?+??????????????)”?“????????IP?”?“??????????”???????????

(???????????????)????????????????

????????????????????,????,2023?????????????????7?26?,???????????(65.21.XX.XX)?????,??,??????????????,???????,??????????????????????1.03GB???????,?????“?????????”?????????“tip4XXXXXXXX.php”?

(?)???????????

?,??,???,?????????SSH????????????????,???????????????,??

????????????????

(??????)??????

?????????????????,?22??????????????????????8?????????????,?10????????????????????????????20?,???,????????

(?)????????

2023?5?2023?10????????,????????????????????30?,?IP?,????

(?????????????????)????

???????????????????????????2???????????????PIPE???????????“c:\windows\system32\”????????????,???????????????????.net?????,?,??????????????KB,??????TLS?????????????????????????,???????????????????????https??????????,?websocket+SSH?,???????

?????????????????????IP????

??:??