???????????

2024??????????????12?18??????????,?????????CNCERT?(

???????????????

(??????????????)??

???????????????Exchange???????????????????????????????????????2???????????????????????????Exchange??????????,?,???????,????????

(?)??

???????????????,?2??????,??????????,????,??/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,??????????????????,????????????????????????,????????????????

(???????)?????????????????????30??

???,??????????????????????,????,??SSH?SMB????30?????????????????????????????????????;????????,?????????????????????????????????????????????????????????????,?????websocket+SSH?,?????????????????????????????,?????WeChatxxxxxxxx.exe???????????????2???????????PIPE????,??

??????

(??)??????

????????,????????????,???,????,???????????????????,???????????

(???????)?????

??????3???,???????????????????????????,2023?????????????5??2?,?????(95.179.XX.XX)?????????,??????????????,?,????,??????????????“??”?“?”?“?????”?“?(?+?)”?“????IP?????????????????????????????????”?“??”?????

(?)?

???????????????,?????????,2023?7???????????????????26?,?????????????????(65.21.XX.XX)?,??,????????????,???????????????????????????,??????????????1.03GB??,??????“??????????”??????????????????????????????????“tip4XXXXXXXX.php”?

(?)???

?,??????????????????????????????,???????,???????????????????????????????????????????SSH?,?,??????

?????????????

(???????????????????)?

????????????????????????????,?22??????????8?,?????10??????20????????,??????,???

(???????????????)?

2023???????????????????5????2023??????????10???????????????????????????,????????????????30????????????,??????????????IP?,?????????????????????

(?????)?????

??????????????????2?PIPE?“c:\windows\system32\”?,?.net??????,?,?????KB,?TLS????????????????????????????????????????????????,??????????????????????https???????????????,?websocket+SSH????????????????????????????,???????????????

?????????????????????????IP??

?????????????

2024?12???????????????????18?,??CNCERT?(

????????????????????????????????

(???????????)????

2024????????8??????19???????????????????????????,????????????????,?/??2024???????????????8?21????????????????????,???/??????

(??????????)?

2024????8??????????????21?12?,???,??????????,?????????????????????????,???????????????????/xxx/xxxx?flag=syn_user_policy??????????,?????????????/xxx/xxxStats?

(?)?

2024????????11???????????6??????????2024????11????8?????2024?????????11??16???????????,????????276????????????????????????????????????????????????????

??????????

(????)?

??????IP???????????,??????????,??????,???????????????????????,??????

(??????????)????

2024?11?6?????????????????11?????16??????????????,????????????3?????????????????IP???????????,??????,?,???,?,??????????????????????????????4.98GB?

???

(?)???????????????????????

???????????,?????????????????????22??????????8??????????????,????????????10??20????????????,??????????????,????????????????

(??????????????????????????)????

??????????????5????IP???????,?,??

(???????????????????)?

????????,????????????????????????,????????????????

????,???????????????????????,??????????????

(?)????

?,????,?????????????,???276??,??????????????,???????????????

??????IP????

?????????????????????????:?????

??

??:???????????,??????????,??????????????