???????????????!?????????????????

??

??????

2024?12????????????????????????????18?,?CNCERT???????????(

???

(????)?

??????Exchange???????????????2???????????????????????????Exchange????,?????????????,?????,?????????????????????????

(???)??????????????????????????????????

?,?????2???????????????,????,??????????????????,??????????/owa/auth/xxx/xx.aspx???????????/owa/auth/xxx/yy.aspx,??????????????????,???????,????????????

(?)??????30?????????????

??,???????????,?,?????????????SSH?SMB???????????????30????????????????;???????????,??????????????????????????????,?websocket+SSH?????????????????,????????????????,????????????????????WeChatxxxxxxxx.exe??2????PIPE?????,???

????

(??)??????

?????????????????,?????????????,???????????????????,?????,????,??

(???????????)??????????????

?????3????,??????????,2023?5??????????????????????????????2???????????????,????????(95.179.XX.XX)???????????????,???????,???????????????,?,???????“??????????????”?“????????????????”?“?”?“?????????????(?????????????+????)”?“??????????IP??????”?“???”??

(??????????????????)???

????????????????????,????????????,2023?7??????26?????????????????????,?(65.21.XX.XX)?,???,???????,????????????????????????,??1.03GB???????????,????????????????????????“??”????“tip4XXXXXXXX.php”?

(????)????

?,?,????,???????????????SSH????????????????????????????,????,??????????????

???????????????????????

(?)???????????????

???????????,???????????????????????????22??8?,????????10?20??????????,?,???????????????

(??)?????????

2023?5?????2023??????????????10?????????????????,???????????30????,?IP?,??

(????)?

?2?????????????????????PIPE????????????????“c:\windows\system32\”??????????????????,?.net????????????,??????,?KB,??????????TLS???????????????????,?????https??????????????,????????????websocket+SSH?,??????

??????IP???????????????????????

?

2024?12???18?????,???????????????CNCERT?????????????(

??????????????????????????????????????????????????

(??)???????????????

2024???????????????????8???????????????????19??????????????????????,??????????,???????/?????2024?8??????????????21??????????????,??????/??

(?)??????????????

2024?????8????????????????21??????????????????????????12???????????,?????????????????????????????????????????,?,?????????????????????????,??/xxx/xxxx?flag=syn_user_policy?????,???????????????/xxx/xxxStats?

(???????)??

2024????11????????6???????????????????????2024????11??????????8?2024?11???16?????????,?276???????????????????????????????????????

????

(?)????????????

???????????????????IP??,????????,?????????,????????????,??????

(?)??????????????????????????

2024?11??6???11?16??????,??????????????????????3?????????????????????????????????IP??????????????,?????????????,???????????,?????????????,??,?????????????????????????????????4.98GB?

?????????????????????

(???????????????)?????????

??????????????,?????????22????????8?????,??10??20?,?,??????????

(?)???????????????????

?5???????IP????????,??????????,?????

(????????)????

?,????????????????????????,????????????????????????????

?????????,?????????????????,????????????????????????

(?)?????????

??,???????????????????,??????,?276??????????????,?????????????????,???????????????????

?????????????????????IP??????????????????

??:????

?????????

????????????????????!??????????????????????

????????