?????????????????!???????????????
??
2024?????12??????????????????18?,??????????CNCERT??????????????????????????(
????????????
(??????????????????????????????????)????????????
?????????????????Exchange???????????2???????????????Exchange?,?,????????????????????????,??????????
(?)????????????????????????
?,????2?,?????,??????????????????????????????????????,???????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,????????,?????????,?????????????????
(???????)?????????????????30???????????????????????????
??????????????,??????????????,?,?SSH?SMB????30???????????????????;?,??????????????????????????????,??????????????websocket+SSH??????,??????????,???????????WeChatxxxxxxxx.exe?????????????2??PIPE??,??????
??????
(?)?????????????????????
??,????????????????,??????????,???????,????????????????????,??
(????????)???????????????????????
????????3?????????,???????????????????,2023????????????????5??????????2?????,?(95.179.XX.XX)?,?,?,?,??????????????????????????????????(?+?)???IP?????????????????????????????????????????
(?)?
?????????????,???,2023??7?26??????????????????????,???????????????(65.21.XX.XX)???????????????,?????????????,??,??????????????,?1.03GB????????,???????????????????????????????tip4XXXXXXXX.php?
(???????????????????)???????????????????
?,?,????,?????????????????????????SSH??????,??????,???????????
??????????????
(?)??????
?,?????????????????????????????????22?8??????????,?????10?20????,?,??
(????)?????????????
2023??5?????2023?????????????10???????????????????,?30??????????????,?????IP??,??
(???)???????????
????????????????2???????????PIPE?c:\windows\system32\????,???????????????????????????.net???,???????????????,??????????????KB,?TLS????????????????????????????????????????????????????????????,????????????????????????????https?????????????,??????websocket+SSH????????,???????????????
????????????????????????IP????
????????????
2024???????12???18????????????????????,???????????????????????????CNCERT???(
?????????????????????
(?)?
2024??8???????????????????????19??????????????????????,?????,????????/??2024?8??????????21????????????,???????????/??
(??)???????????????
2024??8????21??????????12???,??????,??????,????,???????????/xxx/xxxx?flag=syn_user_policy?????,??????????/xxx/xxxStats?
(?????)?????
2024????11???????6?????2024????11??????8??????????2024??????11????????16????????,?276????????????????????????????????????
?????????????????????
(???)????????????
?????????????IP??????????????,?????????????????,??,?,????????????????????????
(????????????????????????????)???????????????
2024??????????11???6?11?????????16??????,??????3?IP??????????,?,?????????????????????,???????????,???,??????????????????????????????????????????????????4.98GB?
???????????????
(??)?
?,????????????22?????????8?????????????,????10?????????????????20??????????????????,???????????????????,???????????????????????
(?)???????????????????????
??????????????????5????????????????IP????,????,???????????
(??????????????)??????????????????????????????
???????????????????????????,????,??????????????????
?,?,???????????????
(?)?
?,????,??,?????276????,?????????????????????????????,?????
???????????IP?????
????????:?????????
??