???????????????????

2024???????12?18?????,????????????????CNCERT??????????????(

????????????????

(?????????????)??

?Exchange??????????????????2??????????????Exchange?,???????????????????,???????????????????????????,????

(?????????)?????

????,??2?,?????????????????,????????????????,?/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,???????????????????,??,??

(?????????????)????????????????30????????????

???,?,??????,?SSH?SMB?????????????????????30??????????????????????????????????????;?,???????????????????????????????????????????,?websocket+SSH?,??????????????????????????????????????????,???????????????WeChatxxxxxxxx.exe?????2??????????PIPE??????????,????????????????

???

(??????)?

??,????????????????????????,????,?????????????,??????????????,??

(???????????????????????)?????????????????

??3??????????????????,?????????????,2023??5????2?,????????(95.179.XX.XX)?????????????????,?,????,?,?“?”?“?”?“?”?“???????(???????+?)”?“??????????????????????IP???????????”?“??????????”????????????????????

(?)???????????????????????

??????????????????,????????????????????????,2023?7?26???????????????,????????????????(65.21.XX.XX)???????????????????????,???,??,???????????,?????1.03GB??,???????“?”???????????????“tip4XXXXXXXX.php”?

(??????????)???????????????????

?,??,??????,????????????????????????????????????SSH????????????,??,?????????????

???????????????????????????

(??????)??????????????

???????????????????????????,?????????????22???8??????,???10?20?,???????,??

(??????????)??????????

2023?5?2023?????????????????????????????????10??????????,?30??,?IP??????????????????,??

(????)???????????????

?2??????????????????????????????????PIPE???????????“c:\windows\system32\”????,????.net?,?,????KB,????????TLS????????????????????????,????????????https???????????,?????????websocket+SSH?????????,??????????????

???????????????????IP??

?????????????

2024??????????????12?????18?,????CNCERT????????(

???????????????????

(??????????????)???????????????????

2024??????8????19????,???????????????,????????/??????????2024???????????????8????????????????????????21?,?????????/???????????????????????

(??????)?????

2024??????8?????????????????????21??????????????12?????????,?????????????,??????,???,??????????????????/xxx/xxxx?flag=syn_user_policy?????,????????/xxx/xxxStats?

(????????????)?????

2024????????????11???????????????????????6??2024???????11?????????8??????????????????????????????2024???????????????????????????11?16?????,????????276??????????????????????????????????????????????????????????

??????????????

(????????)????

?IP????????????????????????,?,???????,??,?????

(?)????

2024?????11??????????????6?11?16?,????????????????????3??????????????????????????IP?,?????,?,????????????????,??,????????????????????????4.98GB?

????????????????????

(?)??????

????????????????????????????,??????????????????????22?8????????????????????,?10??????????????20??????????,?,??

(??????)?

???????5??????????????IP?,?????,???

(???????????????????????????)???????????

??????,??????????,?????????????????

?,??????????,??

(???????)??

??,????,???????????????????,?276???????????????????,??????????????????,???????????????????

????????????IP????????

??????:?????

??

??:???????????,??????????,??????????????