?????????????????!???????????????

??

???????????????

2024??????12????18???????,??????????????CNCERT?(

??????????????????

(??)???????????

???????????????????Exchange???????????????????2???????Exchange??,????,????,???????

(??????)???????????????

????????,???????????2???,?,???,?/owa/auth/xxx/xx.aspx??????????????????????/owa/auth/xxx/yy.aspx,????????????????????????????,??,???????

(???????????)????????????????????30????

????????????????,?????,?,???????????SSH?SMB??????30???????????????????????????????????????;???????????????????,????????????????????????????????????????????????????????????????????????????????,??websocket+SSH?????,?????????????????????????????????????????????????,????????WeChatxxxxxxxx.exe??2?PIPE?,?????

???????????????????????

(?)?????????????

?,?????????????????,?????,??????????,????????????????????????,??????????

(??????????????????????)???????????????????

?3???,???????????????????????,2023?5?2?????????????,????????????(95.179.XX.XX)?,?,????????,??????????,?“?”?“?”?“????”?“?????????(????????+?)”?“??????????????????????IP???????????”?“???????”???

(???????)???????????

????????????????,??????????????????????????,2023?????7?????????26??????,?????????????(65.21.XX.XX)??,?,?????,??????????,????1.03GB??,??????“???????????”????“tip4XXXXXXXX.php”?

(?)??

??????????????,?,?,?????????????????????????????????????????SSH?,?????????????????????????????????,????????????

????????

(?)??

??????????????,????????????????22????8???,?????????10???20?,?,???????????

(?????)?????

2023????????????????5??????????????2023?10?,?????30?,?IP?,????????????????????????????

(?????????????????)?

?2?????????PIPE????“c:\windows\system32\”??????????????,????.net??????????,?????????????????,????????????????????????????KB,???????????????????TLS???????????????????????????????????????????????????,?https?????,???????????????websocket+SSH??????,?????????????????

????????IP???????????

????????

2024??????????12??????????18??,????????CNCERT????????????????????????????(

??????????????????????????????????????

(?)?

2024???8???????????????19?,?,??/??2024?8??21???????,???/????????

(?)????????????

2024???????8?21????????12???????????????,????????????????????????????????,???????????????????????????,??????,?/xxx/xxxx?flag=syn_user_policy??????,?????????????/xxx/xxxStats?

(?)??????

2024???????????????????11??????????????6??????????????2024?11????????8?????????2024????????11?16????????????,??????276?????????????

??????????????????????

(??????)????

???????????????????IP?,?,?????????????????,?,????????????

(??????)??

2024?11?6?11??16??,???????????????????3????IP???????????????,?????????????????????,???????????????????????,??????????????????????????,??????????????,???????????????????????????????????????????????????4.98GB?

???????

(??????????????)?

??????,?22??????????8???????,??????????????10?????????????????????20????,????????????,??

(?)??

??????5??????????????IP?????,?,??????

(???????????????????????????)??????????????????????

????,???????????,?????

??????????????????,????????????????????????,???????????

(?)?

?,??????,?????????????,??????????????????????????????????276?????,???????????????,???????

?????????????????IP????????????

???????????????:?????????????????

?????????

??????????????????????!????????????????????

????????