????:1??????????????:??????????

2?????150??????

3???????

4??????

5???????

??????????????

2024??????12??????????????????????18???????????????????????????,?????????CNCERT??????(

????????????????

(?????)?????????????????????????????????

????????Exchange????????????????2?Exchange???????????????,??,????,????????????????

(?????????)???????????

?,??????????2????????????????,?,?????????????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????????????????????????????????????????,?,??????

(?)?30??????????????

??????????,???????????,??????????????,?SSH?SMB???????????????????????????30????????????????????;?????,????????????????????????????????????????????,???????????websocket+SSH??????,???????????,????WeChatxxxxxxxx.exe???????????????????????????2??????????????????????????PIPE????????,??

????????????

(?????????????????)?????????????

?????,????????????????????,??,????????????????,?????,?????

(????????)?

?3????,????????,2023?5????????????????2??????????????????????????????????,????????????(95.179.XX.XX)?????,????????,?,?????????????,???“???????????????”?“?????????????????”?“????”?“????????????????????????????(?+???????????????????)”?“???IP????????????”?“????”???????????????????????

(??????????????)?

????????????,???,2023???????????7?26????????????????????????,?(65.21.XX.XX)??????????????,?,??????????????????,???????????????????????????,?1.03GB???,?“????????”????????????????????“tip4XXXXXXXX.php”?

(?)?

?,?????????,?,???????????????????????SSH????????????????????,?????????????,?????

?????????

(?)???

??????????????,????????22??????????8????????????????,??10????20???????????????????,?,??????

(??????)??????????

2023????????????????????????????5???2023??????10???????,????????30???,?????IP?,????????????????????????

(?)?

??????????2??PIPE??“c:\windows\system32\”??????,??.net?,???????????????????,??KB,???????????????????TLS?????????????,???????????https?????,?????websocket+SSH?,???????

????????IP???????

????

2024????12???????18?,????????????CNCERT?(

?????????????????????

(?)?

2024?????8?19???????????????????????,???????,??????????????????/???2024???????????????8????21??,????/??

(??????????????????)??????????????

2024???????????????????8??????????????21??????????12????????????,????????????????,????,???????????????????????????,?/xxx/xxxx?flag=syn_user_policy???,??????????????/xxx/xxxStats?

(???????????????????????????)?

2024??????????11?6???????????????????????????????2024???11??????8??????????2024?????????????11???????????????????????16?,??????????276?????????????????????????????????????????????????

?????????????????????????????

(????)?

??IP??????????????,??,?,???????????????,????????

(?????????????????????)?????

2024???????????11???????????????6?????????11????16?????????????????????,?3?IP??,?,?,?????????,???????????????,???????????????????????????????????????4.98GB?

????????????

(?????????)?

?,?????????????????22?8???????????????,??????10????????????20????,?????????,??

(?????????)??????

????????????????????????5??????IP?????,??????????????,???????????????

(??????????)?????????

?????????,????????????,????????????

?,?,???

(?)????

??????????????????????,???????,??????????????,??????????276??,???????????,????

?????????????????????????????????????IP????

?????????????:???????????