?????????????????!???????????????

???????????????????????

2024?12???????18?,????????CNCERT??(

???

(???????????????????)?????????????????

??????????????Exchange????????????????2???????????????????????Exchange?????,?,??,???????????????

(?????)???

?????,????????????????2?,?,????????????????,??/owa/auth/xxx/xx.aspx?????????????/owa/auth/xxx/yy.aspx,?????????????????????????????,???????????????,????????????

(??????????)????????30??????????????

??????????????,????????????,??,???????????????SSH?SMB?????30????????????????????????????????;?,??????????????????????????????????????????????????????????????????????????????????????,????websocket+SSH????,???????????,????WeChatxxxxxxxx.exe?????????????2????PIPE?,???

????????????????????????????????

(??)??????

?????????,????????????????????????????????????????????,???????????????,????,?,??

(????)???????????????

??????3?????????????,????????????????,2023?5?2??????????????,??(95.179.XX.XX)??,?,??????????????????????????????,??,?“???????”?“????????????????????????”?“????????”?“????????(???????????????????+?)”?“?IP???????????”?“??”???????

(?????)??????????????????????????

????????????????????????????????????????,??????????????,2023???7??????26????,????????????????(65.21.XX.XX)?????,??????????,?,?????????????????????,??????????1.03GB??????,????“????????”???????“tip4XXXXXXXX.php”?

(?????????????????)?

?,???,???,????????SSH??????,???????????????????,??

????????

(???????????????)???????????

??????????????????????????,???????????????22?8??,?????10?20?,?,??

(???????)??????????

2023????????????????????????5??2023?10??,?30???????????????????,??????????????IP?,??

(?????????????)?

????2?????????PIPE?“c:\windows\system32\”?,??.net????????????,?????,?KB,?????????????????????TLS???????????????????????????????????????????,???????????????????????????https??????????????????,????????websocket+SSH??,???????????????

????????????IP??

?

2024???????????12???????????18???????,?????????????CNCERT????(

????????????

(?)???????????

2024??8????????19?,??,????/??2024???????????8?21??????????????,???????????????/???????????

(?)????????????????

2024?8?????????21?12???????????????,????????????????,??????,??????????,?????/xxx/xxxx?flag=syn_user_policy???????????????,??????????/xxx/xxxStats?

(??????)??????

2024?11?????????6???????????????2024????11??????????8?2024????????????????????????11??????16??????????????,?????276??????????????????????????????????????????????????????????????

????????????????????????????

(?????????????????)????????

?IP?????????????????????????????????,????????????,?????????,??????????????????????,??

(????)?

2024?11?6????????11?16??????????????????,????3??????????????????????????????????IP???????????????????????????,?,?????????????,??????????????????????,??????,??????????????4.98GB?

???????????

(?)?????

?,?22???????????????8?????????,???????????10????????????20????????????,?,???????

(????????????)???????

?????????????5????IP????????????????????????????,????,?????????????????????

(???)?????

??????????,????????????????,??

??????,?,????????

(?)???????????

??????,????,????,???????????????????276??????????????,??????????????????,?????????????????????????????????

???????????????IP?