?????????????????!???????????????
????:2025-01-18 12:02:36 ??:????
????:??????????:???????
????
2024???????????12?18????,????CNCERT??????????(
???????????????
(??????)???????????????
????Exchange????????????????????????????2?????????Exchange???,??????????????????????????????????,????,?????
(?)??????
????,???????????2????,?,??????????????????,?????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????????????????????????????,???????????????????????,?????
(???????????)??????????????????????????30?
?????????,??????,????,???????????????????SSH?SMB??????????30?????????????????;????????????????????????,?????????????????????????????????????????????????????????????????,??????????????websocket+SSH?????????????????????,??????,????????WeChatxxxxxxxx.exe?????2?????PIPE??????????????,????????
????????????
(?)?
?,??????,?????????????,?????????,?????,??????????
(????)???????????
?3?????????????,??????,2023????????????????5???????????????????????2?????,?(95.179.XX.XX)?,????????????,??,???????????????,??????????????????????????????????????????????????????????????????(?+??)????????????????IP??????????????????????????????????????
(????)???????????
???????????,?????????????????????????????,2023??????7?????????????????26???????????,?????????(65.21.XX.XX)???,????????????????????????????,??????????,?,??????????????1.03GB??????,?????????????????????????????????????????????tip4XXXXXXXX.php?
(???????????)?
???????????????,??????????,??????,??????????????????????????SSH?,????????????,??
?????????
(???????????????)??????
?,??22?8??????,?10?20????????????????,???????,???????????????????????
(????????????)???????????????
2023??????????????5??????????????????????2023??????????????????????????????10?,????????30??????,????IP?,?????????
(?)??
???????????????????????2????PIPE??????????????c:\windows\system32\??,?.net??,?,?????????????KB,?TLS?????????????????????????????????????,?https?,?websocket+SSH?,??
??????????????????????????IP????
?
2024???????????12??18?????,??????????????????????CNCERT??????????(
???????????
(?)?
2024??????????8?????????19?,?????,?/????????????????2024??????????????8????21??????,??/???????
(???????????????????????????)???????????????????????????
2024?8???????????21?????????????????12?,?????????,???????,????????,????????????????????????/xxx/xxxx?flag=syn_user_policy?????????????????,???????????????????/xxx/xxxStats?
(???????)???????????????
2024????????????11?6?????????????????????????????2024???11?8?2024?????????11?????16?,???????????????????276?????????????????????????????????????????????????????????
????????
(?????)??????
?IP??,????????????,?????????????,??????????,??
(?)???????
2024???????11??????????6????????????????11??????????????16??????,?3???IP???????????????,??,?,????????????????,???????,????????????????????????4.98GB?
??????????????????
(??????????????????)?
??,??22???8????????,?????????????????10??????????????20?,?????????????????????,????????????????????????
(??????????)??????
????5?IP?,?,??????
(??????????????????????????)?
??????????????????,???????????????????,???????????????
??,??????????????,??
(?????)?
??????????,????????,?,??????276?,??????????,?????????????????????????????
???????????????????????????????????IP??????
???????:???????????????
????
