???????????????!?????????????????

??????????????

2024?12??????????????18????,??CNCERT?????(

??????????????????

(????)??

?Exchange?????????????????????????????2??????Exchange????,????????,?,???????????

(???)???????

??????????????????,?????2????????,????????????????????,???????,??/owa/auth/xxx/xx.aspx????????????/owa/auth/xxx/yy.aspx,?????,??,?????????

(???????????????)????????????????30??

?????????,???????????????????,????????????????????????????,?SSH?SMB??????????????????30??????????????????????????????????????????????????????;??,????????????????????????????????????????????????????,??????????????????websocket+SSH?,????????????,????WeChatxxxxxxxx.exe??????????????2?PIPE????,?????

???????????

(?)?

???????,??????????????????????,????????,?,???????????????,?????

(?)????

?3???,??????????????????????????????????,2023?????????????????5?????????????2?,????????????(95.179.XX.XX)?,?????????????,?,???????????,??????“?????”?“???????”?“???????????”?“????????(???????????????????+?????)”?“?IP??????”?“???”???????????????????????

(?????????)?????????

??????????,???????????????????????????????,2023??????7???26?????,??(65.21.XX.XX)?,??????,?,?,??????1.03GB??,??????????“???????????????”??????????????“tip4XXXXXXXX.php”?

(????????????)????????????????????????????

?,?????????,??????????????????????,?????????????????????????????SSH?,????,??

??????

(??????)?

??????????????,?22?8??????????????????????,?????????????????10???????????????20?,??,????????????

(?????????)??

2023?5????2023???????????????????????????10????????????,??????????30?,?IP??????????????????????????????,???????????

(???????????????)??????

??????2???????????????PIPE???????“c:\windows\system32\”????,????????????????.net????????????,?????????,?KB,??????????????TLS????????????????????????????????,???????????????????https??????????????,?websocket+SSH??????,????????

?????????????????????????IP??????????

??????????

2024???????????????12??18?????,??????????????CNCERT?(

?????????????????

(?)?????

2024?????8???????????19???,????,??/????2024????????????????????????8?21???????????????????????,???????????????/??

(???????????????????????)?

2024???????8????????21?12??????????????????????????????????,???,?????????????,??????????????????????,??????????/xxx/xxxx?flag=syn_user_policy??,???????/xxx/xxxStats?

(????????????????????????)?????????

2024?????????????11???????????????????????????6??????????????????????2024?11??????????????8?2024????????????????11?16????,?276???????????????

???

(??????????????)?

??IP????????????????????????,??????????????,????,???????????????,??

(?)????

2024??????????11?6??????????????????????????11??????????16??????,?3???????????????????IP?????????????????????????????????,???????????????????????????,??????,???????????????????????,?,????????????????????????????????????4.98GB?

?????????????

(???????????????????)?

?,?22??????????????8???????????,?????????????????10??????????????20????,??????????????,?????????????

(??)????????????

????5?IP????,??,??????????????

(??)???

?,?????,????????????

???????????,???????????,???????????????

(????)????

????????????????,?,??????????,?????????????276????????????,????,??????????????????

??????????IP?????????