???????????????!?????????????????

?

2024?12??18?????????,???????CNCERT??????????(

????????????????

(?)?

???????????????Exchange???????????2?Exchange??????????????,??????,????????,???

(????)????

????,?2????????????,???????????????????????????,????????????????????????,????????/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,???????????????????????????????????????????????????,??????,?????????????????

(????)???????30?

?,??????????????????????????,?????????,????????SSH?SMB???????????????????????????30??????????????????????????;??????????????,??????????????????????????????????????????????,??????????websocket+SSH????,???,??WeChatxxxxxxxx.exe??2??????????????PIPE???????????,???????

???????????

(???????)??????

??,??????????????????,???????????,???????????????,??,??

(??)??????

??????????3??,???????????,2023?????5?2???,?????(95.179.XX.XX)??????????????,????????????,???????????????????,?,??“??”?“?”?“?”?“??????(?????????????+???????????????)”?“?IP?????”?“????????????????????”??

(?????????)?

???????????????????????????????????????,???????,2023?????7?26????????,???????????????????(65.21.XX.XX)???????????????,??????????,?????????????,??????????????,?1.03GB????????????,???????????“?”?“tip4XXXXXXXX.php”?

(?????)??

??????????????????????????????,????????,?????????,????????????????????????????????????????SSH?,??????,??????

?????????????????????????????????????

(???)?

????,??????????????????????22?8??????????????,?10?20???????????,??????????????????????,????????????????

(?)????????????????????????

2023????5?????????????????2023?10????????????,???????30?,?IP?,??

(?????????)??

?2???PIPE?“c:\windows\system32\”????,???????.net????????????,?,???????????????????????????KB,????TLS???????????????????????,??????????????https?????????????????,?websocket+SSH?,????????????????????

??????????????????????????????IP??????????????

????????

2024???????????12?18?????,?????CNCERT??????(

????????????

(??????????????????)?

2024?8????19???????????????,???????????,?/??2024????????????8???????????????????21?,????/??

(????)???

2024?????????????????????8??????????????21??????????????????12????,??????????????,??????????????,??????????????????,??/xxx/xxxx?flag=syn_user_policy?????????????,?????/xxx/xxxStats?

(????????????????????????)?

2024????11??????????6?????2024??????11?8?2024?????????????11????????16??????,?276???????????????????????

????????????

(??????)??

??????????IP?????,????,????,?????,??

(?)?

2024?????????????????11????????????????????????????6????????11????????????????????????????16???,????????????????3?????IP???????????,???????????,??????????????????,??????????????????????,????????????????????????,??????????????????????????????????????????4.98GB?

???????????????????????????????????

(?)??

?,??????22??????????8??????????,?????????????????????????????????10???????????????????????20?,???,???????

(??????)??????????????

??5?????????????IP??????????????????????????????????,???????,????????????????????

(??????)????

????,????????????????,???

???????,??????????????????????,??????????

(????????????)??????????????

?????????????,?????????????,???,????????276????????????????????,????????????,???????

????????????????????????????IP??????????????