???????????????!?????????????????

??????????????????????

2024?????12??18????????,??????????????????????????CNCERT????????(

???

(?????)?????????

????Exchange??????????????2???????????????????????????Exchange???????????????????????,???????,????????????????????????,??

(??????????????????????????????)???????????????????

???????????????????,???????2??????,?????????????,???????????????????,?/owa/auth/xxx/xx.aspx????????????????/owa/auth/xxx/yy.aspx,??????????????????,?????,??

(?????????????)????30????

?,??,????,?SSH?SMB??????????????????????30????????????????????????????????????????????;????????,??????????????????????????????????????????????????????,?websocket+SSH???????,????????????????????????????????????,?WeChatxxxxxxxx.exe???????????2????PIPE?,????????????????????????

????????????????????????????

(???????????????????????????)??????

?????????????????????,????????????????????????,?,???????????????,????,??????

(??????????????)?????????????????????????????????

??????????3????????????????????????,???????????????????,2023???????????????????5??2???????????,???????????(95.179.XX.XX)?,???,??????????????,?,????“?”?“???????????????”?“??”?“???(??+???????????????)”?“???????IP?????”?“???????”????

(?????)?????

????????????????????????,???????????????????,2023????????7?26???????????????????????????,?????????????(65.21.XX.XX)????,???????????????????????,????????????????,???,????????????1.03GB??,??????“????????????????????????”??????“tip4XXXXXXXX.php”?

(???????????????)??????

????????,?,??????????,??????SSH??,????????????,?????

?????????????????

(??????)??????????

?????????,?????22??8??????????????????????,??????????10???????????20????,????,???

(????????????????????)?????

2023?5??????????????2023???????????10?,???????????????????30?,?????????????????????IP?????,??

(??????????)???????????????????

??????????????2????????????PIPE?“c:\windows\system32\”?????,??????????????????.net??????,??????,?KB,??????????????TLS????????????????,?https??????????????,????websocket+SSH?????????????,???????????????

????IP????

?????????????????

2024??????12?18?,?????????CNCERT?(

????????????????????????????

(?)?????????????????

2024?????????8?19???????????,????????????,?/??2024????????????8??????????21?????????????????,???????????????/???????????????

(?)?

2024????8?????21???????????12?????????????????,???????????????????????????,?,???????????,???????????/xxx/xxxx?flag=syn_user_policy??,????????????/xxx/xxxStats?

(????)???

2024???????????11???6???2024??????????????????11??8??????2024??11??????????????16?,?276??????????

???????

(?)????????

????IP????????,?????,?,???????,????????????????

(???????????)???

2024??????????????11??????????????6?11???????????????????????16????,?????3??????IP????????????,???????????????,?,??????,???????????????????,???????4.98GB?

?????????????????????????????

(????)??????????

???????????????,?22????8????????????????,??10???????20?,?,?????

(?????????????????)?

??????????????????5?IP?,??????,??

(?)???????????????????????????

??,????,???????????

?,???????,?????

(??????????????)??????????????????????????????????

?????????,???????????,??????,???????????276??????????,??????????????????????????????,??????????????????

???IP??

???????:????????