????:1?100?3??????:??????

2???????

3???????

4???92939598????

5???150??

?????????

2024???????12?18?,?????????????CNCERT?????(

???????

(??????????????????)???????????

?Exchange???????????????????????????????????2?Exchange?????????????,?,????,?????

(??????????????)????????????????????????????

?????,????2??????????,????????????,??????,?/owa/auth/xxx/xx.aspx???/owa/auth/xxx/yy.aspx,???????????????????????????,????,????????????????????????

(??????????????)??????????30??????

??,?,????????????,?????????????SSH?SMB?30????????????????????????????????????????????????????????;?,???????????????????????????????????????????????????,??????????????websocket+SSH???????????????,?????,?WeChatxxxxxxxx.exe???2??????PIPE??????????????????????????????????,??

???

(????????????????????????)?????????????????????

?,????????????????????????????,????????????,???????????,?????????????,??

(????)?????????????????

?????????3??,????????,2023?5???????????2??????,????????????????????(95.179.XX.XX)??????????????????????,??????????????,???,???????????,????“?????????????????????????????????”?“????????????????”?“????????”?“????????(??????+?)”?“??IP????????????????”?“?????”????????

(?)????

?????????????,???????????????,2023??7???????????????????????26??????,??(65.21.XX.XX)?,??????????????????????????????,????,?,??1.03GB?????????????,????????????????“??”?“tip4XXXXXXXX.php”?

(???????????)????????????

???????,?????????,?,??????????????????SSH????????????????,????????????????????????,??????????

???????

(???????????????)?????????

??????????,?22?????????????8??????,?10?????20?,?,?????

(???)????

2023?????5???????2023???????????????????10??????????????,???????????30??????????,????????????IP??????????,??????????????????

(????????)??

?2????PIPE????“c:\windows\system32\”????????,???????????????????????????.net???????????,???????????????,?KB,??????TLS?????????????????????????????????????,??????https????,??????????websocket+SSH?,????????????

????????IP???????????????

??????????????????????

2024????????????????12?18????????????,???????????????????????????CNCERT????????(

?????????????????????????????????

(???)?????

2024?8?????19???????,???????????????,????????????/??2024??????????8???21??????,?/???????????????????

(??????????????)??????????????

2024???????????????8????????????????????21?12??????,??????????????????????????,?,?????????????????,?/xxx/xxxx?flag=syn_user_policy????????????????????,?????/xxx/xxxStats?

(?????????)?????

2024?11????6???????????2024????11?8???????????????2024??11?16??,?????????276????????????????????????

?????????????

(??????????????????????)??????????????

???????????????IP???????????,????????????????????????????,???????????????????????????,?,???????????

(??????????)?????????????

2024?11???????6?11??????????16???,?3???IP?????????,??????????????????????????,?,???,??,???????????????????????????????4.98GB?

?????????????????

(????????)??????

????????,???????????????????22?8?,?10?20?,??????????????,??????????????

(?)??????????????????????

?5????IP????,????,????????????????????

(???????????????????????)??????

???????????,???,???????????????

????,???,??

(????????)?

???????????????,?????,???????,???????????276??,???????,????

?????????????????????IP?????????????????

???????????:???????????????