????:1?????:????

2??????????????

3?????VX

4????????

5???????????

??????????????????????????????????

2024????12?18?????,?CNCERT??(

?????????????????

(?)??????

???????????????Exchange??????????2??????????????Exchange???????????????????,????????????????????????,??????????????,???????????

(??????????)??????????????

???????????,??????????????????2???,????,?????,????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????????????????????????????????????,??????????????,??????????????????

(????????????????????)?????????30????

?,???????,???,?SSH?SMB????????????30???????????????;????,???????????????????????????????????,?websocket+SSH???????????,????????????,??????????????WeChatxxxxxxxx.exe??????2???????PIPE?????????,??????

??????????????

(???????????)?

??????????????????????,????????????,?????????????????,???,???,???????

(????)?

???????????????3?,???????????????,2023?????????5??2???????????,???????????(95.179.XX.XX)???????,?,?,??????,?????????????????“??????????????”?“?”?“?????????”?“??????????????????????????(?+?????)”?“??????????IP??????”?“?”????????????????????????????

(??????)??????????

?????????????,???????,2023??????7?26???????????????????,??????(65.21.XX.XX)?,?,???????????,??????????,???1.03GB???????????????,??????“?”??????????“tip4XXXXXXXX.php”?

(?)?

?????????,????,?,??????????????????????SSH??????????????,????????????,????????????

???

(?)?

???????,?????????????????22??????????????????8??????????????????????????,?????10?20??????????????????????????????,?,???????????

(?)?????????

2023??5?????????????2023????10?????????????????????????????????,???????????????30????????????,?IP????????????,??

(?)???????

??2??????PIPE????????“c:\windows\system32\”???????????????,??.net???????,?,?KB,????????TLS????????????????????????????????????,?https????????????????????????????,??????????websocket+SSH??????????????????????,?????

????IP?

?????????

2024???????????????????12?18????,?????CNCERT?????????(

??????????????????????????

(??????????)??

2024?8???19??,?????,?????????/???????2024?8????21??????,???????????????????/????????????????????????????

(???)???????

2024?8?21????12????????????,???????,??????????,???????????????????????????,???/xxx/xxxx?flag=syn_user_policy?????????,?????/xxx/xxxStats?

(?)?

2024????11?????????????6???2024??????????????????11??????????????8????????2024?11???????????????????????16??,????276?????????????????????????????????????????????????????????????????????

??????????????????????????????????????

(???????????????????????)?

?IP????????????????,?,?????????????,???????????????????????,??????????

(???????????????????)?????

2024?11????????????????6????11??16??????????????????????,??????3??????IP??????,???????,?????,?????????????????,???????????,??????????????????????????????????????????4.98GB?

????????

(???????????)??????????

????????,??????22???????????8?,??????????10?20??,??,?????

(?????????????)?

????5??????????????IP?,????,??????

(???????????????????????)???????

????,??????????????????????,??

???????????????,?,??????????????????????

(???????????????)?

?,???????????????????,??,?276??,??????????????????????????,???????????????????????????????????????????

??????????????????????????????????????????IP?????????????

?????????????????:?????????????