???????????????!?????????????????

?????

2024????????12??????????????????????????18????????,????CNCERT??(

??????????????????????

(???????????????????)??

?Exchange??????????????2?????????Exchange??????????????,??,??,??

(????????????????)??????

??????,?2????????,????????????????,???????????????,????????????/owa/auth/xxx/xx.aspx?????????/owa/auth/xxx/yy.aspx,??????????????????????????????,??????????,??

(?????)?30??????????????????????

?,?????????????????,?????,?????SSH?SMB????????????????????30????????????????????????????;?,??????????????????????????????????????,????websocket+SSH?????,?????????????????,???????????????WeChatxxxxxxxx.exe??????????2??????PIPE???,??

??????????????????????

(?)?????

?,????????????????,???????????,????,?,???

(???????????????)?

??????????3??,??????????????????????????????,2023?5?????????2????,????(95.179.XX.XX)????????????????,???????,??????,??????????,?“??????????????”?“?????”?“?”?“????????????(??+??????)”?“?IP?”?“?”????????

(?)?????????????

???????????????????,?????????????????????????????????,2023???????7???????????26????,??(65.21.XX.XX)?????????????????????????????????,???????,?,??????,?1.03GB??????????????,??????????????????????????????“???”??????????????????“tip4XXXXXXXX.php”?

(?)??????????

?????????????,????,????,???????????????????????????SSH???,???????????????????????????,??????????

??????

(????)?????????

?????????????????,????????22?8???,?10????20???????????????,?,????????

(?)?

2023?????5??????????????2023???????????10???????????????,????30??????????????????,?????????????????IP?,??

(??????????????????????)???????????

?2???????????????PIPE???????????????????“c:\windows\system32\”??????????????,???.net??????,??????,??????KB,????TLS????????????????????????,????https?????,??websocket+SSH????????????????????????????,???

????????IP?

??????????

2024??????????12???????????????18???????????????????,??????????????CNCERT???????(

????????????????????????

(??????????)???????

2024?????????8?19?????,?,??/??2024?????????????????8????21???????????????????????????,?/???????????????

(??????????????????????)?????????

2024??????????????????????????????????8????????????????????????21?12???????????????????????,???????????,??????????????????????,???,??????????????????/xxx/xxxx?flag=syn_user_policy?????????,??????/xxx/xxxStats?

(?)?

2024???11?????????6??2024??11??????8????????????????????????2024??????11?16???????????,????276?????????????????????????????????????????

????????????????????

(?)?

????????????????IP????????????????????????????,???????????????????,???????????,????,???????????????

(??????????)?

2024?11?????????????????????6???????????????????????????11???????????????????16?,?3????????????IP??,??????????????,????????????????,???????,?,???????????????????4.98GB?

?????????????????

(?)???????????????

?????,?????22??????????????8??????????????????????????,??????10?20?,??,??

(?????????????)?????????????

??????????5????IP????,???????????????,??

(???????????)?

??????,????????????,??????????????????

??????????????,???????,???????????

(??????)????????

???????????????????????,????,???????????????????????,?276?,?????????????????,???????????????????????

???????????????IP???????????????????????????

??:????????????