?????????????????!???????????????

?

2024??????????????12?18?,??????CNCERT?(

?????????????????????????????????

(??????????????????????)?????

???????????????????????Exchange??????2???Exchange???????????,??,????????????????????????,????????

(????????????????)??????????????

????????????????,?2?,??????????,??????????????????????,???????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????????,?,?????

(????????)?30????????????

?,???????,??????????,????????????SSH?SMB??????????????30????????????????????????????;???????????????,??????????????????????????????????????????????????????????????,????websocket+SSH??????????????,???????????,?????WeChatxxxxxxxx.exe?????2???????????PIPE?,????????????????????????????

???????????????????????

(??????)?

?,???????????????????????????????????????????,?????????????,????,????,??

(???????????)?????

??????????????????????????3?,????????,2023?????????????????????5??????????2?,????????????(95.179.XX.XX)??????????????,???????????????????????,?,??????????,?“??????”?“???????????????????????????”?“?????????????????”?“??????????????(???????????????+??????????)”?“?IP?????????????”?“????”????????????????????????

(?????????)??????????????????????????????????

?????????????????????????????????,????,2023???????????7??????????26?,?(65.21.XX.XX)?,??,??????????????,?,??????????????1.03GB??,?“????????????”???????????????????“tip4XXXXXXXX.php”?

(?????????)???????????????

??????????????????????????????,?????,???,?????????????SSH??????????,??????????????,????????????????????????????

????

(???????)????????????????????????

????????????,?22????8???????,??10?????????????20??????????,?,???

(?)???????????

2023???????????????????5?2023????10?????,??????30???,??????IP??????????,???????????????

(??????????)???????????

?2????PIPE??????????????????“c:\windows\system32\”?????,??????.net?????????????,??????????????,?KB,?????TLS??????????????????????????????????,???????????????https?????????????????????,?????????websocket+SSH?,????????????????

?????????IP??????????

???????????????

2024?12????18???????????????????????,?????????CNCERT?(

??????????????????????????

(?????)??????

2024??????8???????????19??????,??????????????,???????????????/??2024?8???????21?????????????????,????/??

(????)?

2024?8?21???12????,????????????????,?????????????????,???,?/xxx/xxxx?flag=syn_user_policy??????,?/xxx/xxxStats?

(?????????)??????

2024?????11?6?????????2024?11????????8????2024??????11???????????????????16????,???276???????????????????????????????????????????????????????????????

????????

(????????)??????

?IP??????????????????????,??????,????????????????,????????????????????,???

(??????????????)?

2024???????????????????11?6????????11???????16??????????????,?3????????????IP???,?,??,???????????????????????????,???????????,????????4.98GB?

???????

(??)???????????

??,?22?8?,?10??????????20????????????????????????????,??,???

(???????????????????????????)????

???????????????????5?IP?????????,?,?????

(?????????????)???

????????????,??????????????????????????????????????????????????,????????????????????

??,????,???????

(?)?????

????,??,??,?????????276????????,?????,???????????????

??????????????????IP??

???????????:???????????????????????????