????????

2024????????????12?18?,?CNCERT??????????(

????????????

(???????????????????)?

?Exchange????????????????????????2????Exchange???,????????,?,???????????????

(????)?????????

?,?2?,????????????????,????????,???/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,?????????????,??,??

(???????????????????????)???????????????????30???????

???????????????????????,?,????????????????????????,?SSH?SMB?????30???????;?????,?????????????????????????????????????????????????????????????????????,??????????websocket+SSH?,????????????????????????????,???WeChatxxxxxxxx.exe???????2??????PIPE??????????????,??????????

????????????????????????????

(?????)?

?????,?????????????????,?,???????????,???????????????????,??????????

(?)???????

???????????3???????????,???,2023????????????????5?????????????2?,?(95.179.XX.XX)???????????????,????????????????????????????,??,??????????,??????????????“?????????????????????”?“?”?“?”?“????????????????????????????(?????????????+?)”?“??IP??”?“??????”????

(??????????????????????????????????)?

?????????????????????????????,????????,2023??7???????????????26??,??????????????(65.21.XX.XX)?????????????????,????????????????????,???????,??????,????????????????1.03GB????,??????????????“?”??“tip4XXXXXXXX.php”?

(?????????????)?

???????????????,??????????,????,???????????????????????SSH??????????????????????????,?????,??

???????????????????

(??????????????????????)?

?,????22???????????????8?????,????????10???20???,?,????????

(?????????????????)??????

2023???????????5?2023??10???????????,??????????30???,????IP??????????,???????????

(????)??????

??????????????2????PIPE??????????????“c:\windows\system32\”????????,????????????.net?,?,????????????????KB,????TLS??????????????????????????????????????,?https?,??????websocket+SSH???????????,??

??????????????????????????????????????????IP???????????????????????????

?

2024????12?????????18??,???????????????CNCERT?(

????????

(????????????)?????????

2024?8????19??????????????????????,????,??????????????/?????????2024???????8???????????????????21?????????????,??????????????/???????????????????????

(????????????)?????????

2024?8???????21????????????12??????,???,?,???????????????????????????,?/xxx/xxxx?flag=syn_user_policy??????????????????????????????????,?/xxx/xxxStats?

(?????????????)??????????????

2024?11???????????6??2024???????11?????8????2024?11?????16??????????,????????????????276?????????????????????????????????????????????????

?????????????????????????

(?)????????

??IP??????????????,??,???????,?????,????????????????

(???????????????????)??????

2024?11????6?11????????16???????,??????????????3??????????????????????????IP?,???,?,????????????????????????,?????????????????,?????????????????????????????????????????????????4.98GB?

???????

(?)?

??????????????????,????22??8???????????,????????????10?????????20??????????,????,???????

(???????)??????

??????5????IP?,?,?????????

(???????????????)????

???????????,???????????,??????????????

??,?,?????????????

(?)???????????

?,????????????????????????,???????????????????,???????????????276?????????,?????????????????????????????????????????????,????????

????????????IP????

??????????????:???????????

??

??:???????????,??????????,??????????????