?????????????

2024???????????????????????????12??????????18????????????????,???????CNCERT?????(

?????????????????

(???????????????????)????????????

??????Exchange?????2?????????????????Exchange?,??????????,????????????,???????

(?)??????????????????????

???,??????????2?,???????????,???????????,????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????????????????????????????,?,????????????????

(???????????)??????30?

??????,??????????,?,????SSH?SMB?????30???????????????????????????????????????;????,??????????????????????????????????????????????????????????????,???????????websocket+SSH????,???,???????????WeChatxxxxxxxx.exe???????????????????????????2????????????????????????PIPE??????????????,??

??????????????

(?)????????????????????????????

????,????????????????,????????????,?,?,????????????????????

(?)??????????

??3??????,???????????????????????????,2023??????5?2??????,????????????(95.179.XX.XX)?,???????????????????????????,????????,???????????,?“?”?“??????”?“?”?“???????(?+?)”?“??????IP???”?“????????”????????????????

(?)???????????????

?????,??????,2023???????????7????26???????????????????,?(65.21.XX.XX)??,??????,???????????????????,??,??????????????????????????1.03GB?????????????,?????“?????”?“tip4XXXXXXXX.php”?

(????????)?

???,??????????????????,?????,?????????SSH????????????????????????????,??,???????

?????????????????????

(????)?

??,????????????????22?8??????????????????????,???????????10?20??,????????????????,???????????

(????????????????????????)??

2023???????5????2023??????????????10???????????????,?30?,?IP??????????????,????

(????)??????????

???????2???????????????????PIPE?????“c:\windows\system32\”?,????????????????.net???????????????????,??????????????,???????????????????????KB,??????????????TLS??????????????????????????????????????????????????????????????????,???https?????????,?????????????websocket+SSH?,?????????????????????

?????????????????IP?

?????????

2024??12???????????????18?????,???????CNCERT?????????(

???

(??????????????)???????????????????????

2024?8?19??????????????????,?????,?/?????????2024?????????8???????????????????????????21??????????,??????????????????/????????????????

(???????????)?????

2024??8???????????????????????21?12????????????,????????????????????????,?,???????????????????????????,??????????/xxx/xxxx?flag=syn_user_policy???????????,?/xxx/xxxStats?

(?)?????????????

2024??????????????11?6?????2024????11??????????????????????8??????2024?11?????16?,??????????????????????276???????????????????????????????????????????????

???????????????

(????)??????

?????IP???????????,?????????????,?????????????????????,?,?????

(?)?

2024????????????????????????11????6?????11???16?,??3????????????????????IP??????,?,?,????????????????????????,??????,???????????????????4.98GB?

??????????

(??)?

??????????????,???22?????????8?????????,??????10????????????20????,?,????????

(?)?????????????

?5????IP???????,????,??????????????

(????????)?????????????????

?,???,???????

????,?,???

(??????????)????

???????????????,??????????????????????????????????,???????????,??????????????276?,??????????????????????????,??????????????????????

?????????????????????????????????IP?

??:??????????

??

??:???????????,??????????,??????????????