??

2024?????????12????????????????????????????18?????????,????????????????CNCERT????????????(

????????????

(?)???????????

????????????Exchange????????????????2????????Exchange??????????????,?????,????,?????????

(?)???

????????????????????,?2????????,?,??????????,???????????????????????????/owa/auth/xxx/xx.aspx??????????????????????????/owa/auth/xxx/yy.aspx,???????????????????????????????,?,???????????????

(?)???????????30??????????????

??????????,?,??,????SSH?SMB?30???????????????????????????????????;???????,???????????????????????????????????????????????????,??????????????????websocket+SSH??????????,?????????????????????????????,?????????WeChatxxxxxxxx.exe????2?????PIPE?????????????,??????????????

???

(???????)????????????

????????????????,??????????????????????????????????,???,???????????????,???,???????????????????????????????????

(????)??????

????????????????????????3?????????,????????????????,2023?????????????5?????????????2?,????(95.179.XX.XX)????????????????????????,???,???????????,??????????????????????,????????“?”?“??????????”?“?”?“?(?????????????????+?)”?“?????????????IP???????”?“??????????????????????”??

(?)???????????

????????????????,???????????????????????????????????,2023?7????26??????????????,??(65.21.XX.XX)??????????,???????,?,???????????????????????????,?????????1.03GB??????????,??“??????????????”?“tip4XXXXXXXX.php”?

(????)??????????????

?,??,???????,????????????????SSH?????,?????????????,????????????????

??????????????????

(??????????)?????

???????????,????22??????8??????????????,???????????????????10??????20?,????????,???

(?)???????????????????????????

2023????5???2023????????????10????????????,??????30?,????????????IP?,??

(??????)???????????????????

???????????????2????PIPE????“c:\windows\system32\”??????????,?????.net?,???????????,???????????????????KB,?TLS??????????????????????????????????????????,?https??????????????,???????????????websocket+SSH???????????????,??????????

?????????????????????????IP?

????

2024??12????18????,?CNCERT??????(

???????????????????

(???????????????????)?????????????

2024????????8????19??,???????,?/???????2024?8??????21?,????/??

(?????????????????)?

2024??????????8?21????12?,????????????????????????????????,?????,????????,???????????????/xxx/xxxx?flag=syn_user_policy???????,???????????????/xxx/xxxStats?

(???????????????????????????)?????????????????

2024?11?????6????2024?????11??????????8?2024?11????????16?????,??????????????????????276?????????????????????????????????????????

?????????????????????????

(?)???????

????IP???????????????????,??,?,?????????????????????,??????????

(??)?

2024?11???????????6?????????????????????11?16???????????????,????3???????????????????????IP?,?????,?,?????????,?,?????????????????????4.98GB?

?????????????????????????????????

(??)???????????????????????

??????????????????????????,?????22??8?????,??10??????????????20?,???????????,??

(?)??????????????

?????????????????????????????????5???????????IP??????????????,???????,??

(??????????)?

???,???,??????????

????????????????,?????,???????????

(?)????????????????????

??,?????????????????,?,??276???????,?????????????,?????????

??????IP?

?????:????????????????????

??

??:???????????,??????????,??????????????