???????????????!?????????????????

????????????

2024???????????????12??18?,?CNCERT????????????????(

????????????

(?)???????????

???????????????????Exchange???????????????2?Exchange??????????,???????????,??????????,??

(??)?

?????,?2?,???????????,???????,?/owa/auth/xxx/xx.aspx?????????????/owa/auth/xxx/yy.aspx,?????????????????????????????,?????????????????,???????

(????????)?30????

????,??????????????,?,????SSH?SMB??????30???????????????????????????????????????????????;????????????,?????????????????????????????????????????????????????,??websocket+SSH?,???????????,??????????????????????????WeChatxxxxxxxx.exe????????2??????????????????????PIPE?????????,?????????

???????

(???????????????????????)?????????

??????????,????,?,??????????????,????????,???????

(?????????)??????????

????????????????????3??????????????,??????????,2023????5?????????2???????????????,?(95.179.XX.XX)???????????????,???????????????????????,????,?,??????????????“?”?“???????????????????????”?“?”?“?????????(??????????+?????)”?“?????????????????????IP????????????”?“????????”????

(??)?

???,??????????????????????????????,2023????7?26?????,?(65.21.XX.XX)????,??????????????????????,?,???????????????,?????1.03GB???????????????????????,?“???????????????????????”?“tip4XXXXXXXX.php”?

(??????)??

???????????????????????????,?,????????,????????????????????????SSH????,?????????????????,?????

????????????????????????

(?)????

????,????22?????8?,??????10??????????????????20???????????????????,?????????,???????

(??)?????

2023?5???????2023?10?,??????30?,??IP?,???????????????????????????

(??)??????????

??2??????????????????????PIPE?“c:\windows\system32\”???????,???.net?,?,?????KB,?????????TLS?????????????????????????????????????????????????????,?https??????????????,??????????websocket+SSH??????????????????,?????

?????????????????????????????????????????????????????IP?

????????????????

2024???????????????????????????12??????18???,?????????CNCERT???(

?????????????

(????)?????????????????????????????????

2024??????????8?????????????19??,?,??/??????2024???????8?21?,???/???????????

(????????????????????????)????

2024?8????21???????????????12?,??????????,?????????????,????????????????????????????,????????/xxx/xxxx?flag=syn_user_policy????,????/xxx/xxxStats?

(?????)????

2024???????????????????11??????6?????????2024??11?????8????????????????2024?????????????11??16????????????,?????276????????????????????????????????????????????

?????????????????????????????????????

(?????????????)??????????????????????????????

??????????????IP????,?,??????,?,??

(?????)???????????????

2024?????????????11????????????????????????6???????????????????11?16???????,????????????3?????????????????IP??????????????,???????????????????,??????,??????????????,???????????,????????4.98GB?

???????????????????????

(?)?

???????????,?22??8?????????????????,??????10???????20??,???????,????????????

(???????????????????)????????????????????????????

?5?IP?,??????????,??

(???????????????)??????????????

??????,?????????????????????,?????????????

?,??????????????,???????????????

(???????????)??

????,????,??????,???????????????276?????????,????????????????,??????????????????????

????????IP????????????????????