?????????????????!???????????????

????????????

2024?12????18????,???????????????????CNCERT????????????(

???????????????????????????????????

(???????????????????????????)?????????

?Exchange?????????????????????2???????????????Exchange?????????,????,??????????????,??

(???????????????????)??????????

????,????2????????,??????,???,?????????/owa/auth/xxx/xx.aspx??????????????????????/owa/auth/xxx/yy.aspx,?????????????????????????????,???????????????,??

(????????????????????????????)?30?

???????????????????????,?,??????????????,?SSH?SMB?30??????????????????????????????????????????????????????;?????,???????????????????????????????????????????????????????,?????????????????websocket+SSH??????,????????,???????????????????WeChatxxxxxxxx.exe???????????2?PIPE?,???????????????????????????????

??????????????????????????

(?)????

?,????????????,????????,???????????????,??,???????????????

(?????????)?

???????3?,???????????????????????????????????????,2023?????????????5?????2??????????,??????????????????????????(95.179.XX.XX)?,???,?????????????????????,????????????,???????????????“??”?“?”?“?”?“?????????????????(????????????????????????????+???????????????????????????)”?“??IP?”?“????????????????”???????

(?????)???

?????????????????????????????????????????????????,????????????????,2023??????????????7??????????26???????????,?????(65.21.XX.XX)????????????????????,?????,???????????????,??????,???????????1.03GB??????????????,?“????????”?“tip4XXXXXXXX.php”?

(??????)?????????????????????

?,??????????????,???,????????????SSH??,??,???????

???????????

(??????????????)?

??????????????????????,??22?8??????,????????????10?20?,????,??

(???????????)??

2023?5??????????????????????????????????2023???????10?,???????????????????????????30?,?????IP?????,????

(????????????)??????

?????????????2?PIPE?“c:\windows\system32\”?????????????????,???????????????????.net???????,????,?KB,?TLS????????????????????????,??????????????https??????????,????????????????????????websocket+SSH?????????????????,????????

???????????????????????????IP???????????

????????????????

2024?12??????????18???????????,?????CNCERT????(

???

(?????????????)??????????

2024????8?????????19?,???????,?????/????????????2024???????8???????????????????????21?????,??/????

(???????????????????)??????????????????

2024??????8?????????????21?12?????????,??????????????????????,??????????????????????,??????,????/xxx/xxxx?flag=syn_user_policy???????,??????????/xxx/xxxStats?

(?)??????????????????????

2024??????11??6??2024?????????????11???8???????????2024?11???????????????16?,?276?????????????????????????????????????????????????

???????????????????

(?)????

?????IP?,????????????????,???????????????????,?,??

(??????)?

2024???????11?????????6????11??????????16?,?3??IP???????????????,??,????,???,??????????????,?????????????????????????4.98GB?

???????

(??????)?????????????

??,??????22??8?,????????10?20?,???????????????,?????????????????

(?????????????????)??????????

???5??IP?,????,????????????????????

(?????????)?

???????????????????????,???????,??

??????????,???????,????????

(??)????????

??????,?????????,??????????,?276??????,????????????????,??????????????????

????????????IP?????

?????????????????:?????????????