???????????????!?????????????????

??????????????????????

2024???????????12?????18??????????????,????????CNCERT???????????????(

????????????????????????????

(????????????????)????

??????????????Exchange??????????????????2????????????Exchange????????,???????????????,??????????????????????????,???????????

(??)??????????????????????????????

?,??????????2??????????,????????????,????,?/owa/auth/xxx/xx.aspx?????????/owa/auth/xxx/yy.aspx,????????????????????,?,??????

(????????????????????????)????30??????????????

???????????,????????????????????????,??,?SSH?SMB?30?????????;??????,???????????????????????????????????????????????????????????????????????????,????websocket+SSH?,?????????????????????????,?WeChatxxxxxxxx.exe????2??????????????PIPE????,????????????????????

????????????????

(??????????)??????

?,?????????????????????????????,?????,?,?,??

(???????????)????????????

?????????3???????????????????,??????????????????,2023??????5????2??????????,?????(95.179.XX.XX)?????????,??,?????????,??,??“?????????????????????”?“?”?“????????????”?“????(???????????????+???)”?“?IP??????”?“????????”??

(?)?

??????????????????????????????????????????????????????????,???????????????????,2023???????????????????????????7???????????26?,??(65.21.XX.XX)??????,????,???????,????????????,???????????????1.03GB?????????????,????????????????????????????“??????????????????”??????????“tip4XXXXXXXX.php”?

(?)??????????

??????????????,?,???????????,????????????????????????????SSH??????????,???????????????????????,??

??????????????????

(????????????????????????)???????

?,????22???????8??????,????10?20???????????????,?,???????

(??????)?????

2023????5??????2023?10??????????,??30?????????????,??????????????IP?????????,????????????????????

(??????)??????????

?2?????PIPE??????????????“c:\windows\system32\”?,??????????????.net???????????????????????,?,??????????KB,?????TLS?????????????????????????????????????????????,??????????https????,???????????websocket+SSH??????????,???????????

??????????????????????????IP???????????????

?

2024?12?????????????????????18????????,????CNCERT?(

???????????????

(??????????????)????

2024?8?19?????????,?,??????????????????????/???2024????????????????8?21???????????????????????????,?????????????/??????????

(?????????)?

2024????8?21?12?????????,???????????,???????,????,???????????????????/xxx/xxxx?flag=syn_user_policy??,????????????????????/xxx/xxxStats?

(?????)???????

2024?????????????????11???????????6???2024?11?8???????????????????????????2024???????????????11????????????????????16????????????,?????276????????????????

???????????????????

(??????????????)?????????????

???????????????????????????IP?,?,?,???,????????

(?????)??????

2024???????????????11?????????????6?????11??16????????????,???????????3?IP?,?,????,??????,??????,????????????????????????????4.98GB?

????????????????

(???????????????????????)?????

???????,??22????8?,??10????20???????,????,????????????

(????)????????

?5????????IP????????????????,?????,???????????????????????

(????)??????????????????

???,?????????????????????,??

????,???,??

(?)???????????????

?,?,?,?276?,??????????,??????

??????????????????????????????????IP?????????????????