?????????????????!???????????????

??

?

2024????????????12??????18?,???CNCERT??(

???????????

(?????????)???????

???????????????????Exchange?????????????????2??????????????????Exchange???????????????????????,?,???????????????????????????,????????????

(???????????)???????????????

????????????????????????,???????????????????????????2??????,???,????????,?/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,?????????,?,?????

(??????????)?30?????

??????????????,?,??????,???SSH?SMB????30?????????????????????????;?????????????????,??????????????????????,?????????????websocket+SSH??????????,???????,??WeChatxxxxxxxx.exe????????????????2?????????PIPE?,?????????????????

???????????????????????????????????????????????????????????

(?)?

??????????,?????????????????????????,????????,???????,??????????????,???????????????

(??????????????????????)??????

??3?,????????????????????????????????,2023?5????????????????????2?,????????(95.179.XX.XX)???????????????????,????,?,???,??????????????“?????”?“?????????????????”?“??????????????????????????????”?“????????(??????????+???)”?“?IP???????????????”?“??????????”??????????????

(??)??????????

???????????????????????????,???????????????,2023????????????????7????26?????????,??????(65.21.XX.XX)?,?,????????,?,?????1.03GB?????????????,?“?”?????????????????????????????????“tip4XXXXXXXX.php”?

(??????????????)?

?????,?????????????,???,??????????????????????????SSH??,???????????????????,??????????

???

(?)?????

?,??????????????22?????8?,?10???????20?,??????,???

(?)?????

2023??????5????2023????????????10???????????????????????????,????????????30??????????????????????,??????IP???????????,???

(????)????????????

???????????????????2????????????PIPE??“c:\windows\system32\”?,??????????.net????,????,???????????????????KB,?TLS???????????????????????????,?????????????????https????????????????????????,?????????????websocket+SSH????,??

??????????????????IP?

??????

2024??????????????????????????12???????????18??,?CNCERT???????(

????????????????

(?????)?????

2024???????????8???????19?,?,?????????/?????2024????????????????????????????8??????????21???????????????????????????,????????????/???????

(???????????????)???????????????????????

2024?8??????????????21??????????12??,????????????????,?,????,??????????????????????????/xxx/xxxx?flag=syn_user_policy???,???????/xxx/xxxStats?

(???????????)?

2024???????11?????????6?????2024??????????11??????????????8??2024??????11????16?????????????,????????276??????????????????????????????????

??????

(????????)???????????????

????IP?????,???????????????????????,?,?,???????

(?????????)??????

2024??11???????????????????6????11????16????????,?????????????????3?????????IP????,???????????????,?,???,??????????,???????????????????????4.98GB?

????????????????

(????????????????????????????)?????????????

?????????,?22?????????????????8???????????,????10?20??????????????????????,??????????,??????????????

(??????????????)??

???????????????????5?IP???????????????,??????????????????????,??

(?????????????????????)?

??????????,???????????????,?????????

??????????????????,?,??

(?????)???????????

?,???????,????,???276?,???????????,???????????????????????????

???????IP???????????

???????????????:???????????????

?????????

??????????????????????!????????????????????

????????