�??????????�????

????:100?????:??????????

??????????????

2024????12??????????????????18?,????CNCERT?????????(

?????????????????????????????????????????

(???)??????????????

?Exchange?????????????????2???????Exchange?,?????????,???????????,?????????????

(?????)??????????

??,?????????????2???????????????,???????????????,????????????,?/owa/auth/xxx/xx.aspx???????/owa/auth/xxx/yy.aspx,?????????????????????????????????????,????,????????????????????

(?????????????????)????30??????

???,??????????????????,??,??????????????SSH?SMB???????????30????????????????????????????????????????????????????;?,????????????????????????????????????????????????????????????????????????????,??????????????websocket+SSH?,????????????????????,???????????????WeChatxxxxxxxx.exe???2??????????????PIPE????????,???

????????????????

(?)??????

?????????????,??????????,????,????,?,????????

(?)??????????????????????????????????

????????????????????????3?,???????,2023????????5????2???????????????,?????????????(95.179.XX.XX)??,??????????,?,????,?�?????????????????????????????????�?�??�?�??�?�?????(?????????????????+?????????????????????)�?�?????IP??????????????????????????�?�?�???????????????????????

(??????????????)??????????

?????????????????????,???????,2023?7?26??????????,????(65.21.XX.XX)??????????????,??????,?,??????????,?????????1.03GB????????,?????�?�??????????????????�tip4XXXXXXXX.php�?

(?)??????????????

?????,?????????,????,????????????????????????SSH??????,??,??

???????????

(???????)?

?,??????????????????????22???????????????????????8?,??????????10??????20????,?,???

(???????)?

2023?5??????????2023?10?,????30?,???????????????????IP??????,?????????

(???????????????????????????)???????????????

???????????2??????PIPE????�c:\windows\system32\�????,?.net???????????????,???????????????????,?KB,??TLS?????????????????????,?????https???????????????,????????????????websocket+SSH??????,??

?????????????IP???????????????????????????

????????????????

2024?12??????18???????????????,????????????????CNCERT??????(

???????????????????????????

(?)????

2024?????????8???????????19????????,?????????????,?????????????/???????2024?8????????????21??,?????/???????????????

(?)??????

2024???????????8???21?12????,??????????????????????????????,???????????,???????????,??????????????????????/xxx/xxxx?flag=syn_user_policy???,?/xxx/xxxStats?

(?)???

2024??????????????????????????11????6???????2024???????????11????????????????????????????8???????????2024???????????????????11????????????????16?,???????????276?????????????????????????????

???????????????????????????????????

(???????????????)?

????????????????????IP????????????,?????,?,?????????????????,??

(??????????)?

2024?11??????6????11???????????????????????16?????,??3????????IP???????????????????,????????????????,????,???,?????,??????????????????????4.98GB?

????????

(??)?

?,?22???????8?????????????????,?10???20?,??,??

(?)?

???????????????????5?????????IP????????????????????????,??,??????

(??????????????)?

????,??????????????,??