????:1??????????:????????

2???app????

3?????????????

4????????????

5??????????

?

2024??12????????18???????????????,????????CNCERT??(

?????????????????

(?????????)?

?Exchange?????????????????????????????????????????2??????????Exchange?????????????????????????????????,????????????????????????????,?????,???????????????????????????????????

(??????????)??????????????

???????,??????????2?????????????,??????,??????????????????,??????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,????????????????,??,????????????

(???????)????30?

?,???????????????????????????,???????????,?SSH?SMB??30????????????????????????????????????????????????;??????????????,???????????????????????????????????????????,????????????websocket+SSH????????????,????????????????????????????,?????WeChatxxxxxxxx.exe??2??PIPE????????????????????,???????

?????????????????????

(?????)???????????????????????????

???????????????????,????????????????????????,?????????,??????????????,????,??????????????????

(?)?

????????3?????,??????????????????????????,2023???????????5???????2????,????(95.179.XX.XX)????,??????????,????????,?????????,???“???????????????????”?“???”?“??????????????”?“?????(????+?)”?“??????IP?????????”?“?”???????????????????????

(???????????????????????????)?

???????????????????,????????????????????????,2023??????????????7????????????????26?,?????????(65.21.XX.XX)???????????????????,??,????,?,?1.03GB?????,?“????????????????”?“tip4XXXXXXXX.php”?

(?)????

?,?,?????????,?????????????????????????????????????????SSH??,???????????????????,?????????????

??????????????????????????????????

(????)?????

?,???????????22?????8????,??????????????10?20?,??,???

(??????????)????????

2023??????5?2023????????????????????????????10???,??????30?????????,???????????????IP??????,???????

(?)?????

?2?????PIPE?“c:\windows\system32\”?,?.net????????????,?????,???????????????KB,?????????????TLS??????????????????????????????????????????????????,??????????https?,?????????websocket+SSH????????,?????

???IP?????

??????

2024???12????18????,?????CNCERT????????????????(

???????????

(???????)?

2024??????????????8????19????????????????????????,?,??????/???????2024???????????????8????????21????,???????????????/??????????????

(?????????????????)?

2024??8?????????????21???????12?,????????????????????????,???????????????????????,????????????,??????????????/xxx/xxxx?flag=syn_user_policy???,???/xxx/xxxStats?

(?)??????????????

2024???????????????????????11?6??2024???????????????11???????????8?????????????2024????11???????????????16?,?????????????276??????????????????????????????????

??????????????

(????????????????????????)?

?IP????????????,????????????????????,??,?,???

(??????????????????)?

2024????????11??6??????????????????????11???????16???????,??3????IP?,???????????,??,???????????????????????????????????,??????,????????????????????????????????????4.98GB?

?????

(???????)???????????

???????????????????????,??????22?8??????????,???????????10?20?,???????????????????????,???????

(??????????)?????????????????

?5???IP????,?,??

(???????)?

???????,???????????,??????

?????????????????????,??,????

(??????????????????????????)???????????

?,??,?,?276?,??????????????????????,????????????????

????????IP??????????????????

?????????????????:???