?? ?????????????????!???????????????
????:1????98?:??????
2???????????
3???????
4??????????
5?????wx
????????????????????????????
2024??????12???????????18?,???????????????CNCERT?(
???????????????????????
(??????????????)???????????????
????Exchange????????????????????2??????????Exchange??????????,?,?,?????
(??????)???????????????????
??,?2????????,????,???????????????????,???/owa/auth/xxx/xx.aspx?????????????/owa/auth/xxx/yy.aspx,?????????????????????????,????,?????????
(??????????????????)??????????????????????????????????30?????
??,?????????????????,????,?SSH?SMB??????????30??????????;???????,???????????????????????????????????,????????????????????????websocket+SSH??????,????????,?WeChatxxxxxxxx.exe??????2????PIPE?????????,??????
????
(??????????????????)?
???????????,??????????????????,?,????????????,??,??
(??)???????????????????
????????????????????????3?,??????????????,2023????5????2?,????????(95.179.XX.XX)????,?????,??,??????????,?????????????????????????????????????????????????????????????????????(?+??????)???????????????IP????????????????????????????????????
(????)?????
????????????,?????????????????,2023?7???????????????????????????26?,??????????????????????(65.21.XX.XX)??????????,??????????,????,??,?1.03GB????????????????,????????????????tip4XXXXXXXX.php?
(????????????)????????????????
?,??,??????????????,?????????????????????????????????????SSH??????????????????????,?,??
???????????????????????????
(???????????????)????????????????????
?,?????????22??????????8???????,?????????????10?20??????????,????,???????????
(?????????????????????)?
2023???????????5???????2023?????????10?,???????30??????????????,??????????????IP?????????,?????????
(????????????????????????????)?
?2??????????????????????PIPE?c:\windows\system32\??????????????????,?????.net?,????????,????????KB,???????????TLS??????????????????????????????????????????,???????????https?,???????websocket+SSH????,????
??????????????????????????????IP????????????????
??????
2024????????????12??????????????????????????18?,?CNCERT???????????????????(
????????????????????????????
(?????)?
2024???????8?19????,??????,?/???????2024????????8???????????????21?,????????????/??
(??????????????)???????????????????
2024????8???????????????????????21?12????,?????,?,??????????????????????,??????????????/xxx/xxxx?flag=syn_user_policy??????????????????,?????/xxx/xxxStats?
(?)???????????
2024?11?6?????????????2024?????????????????????????????????11?????????????????8?2024?11???????????????????16???????????,??276??????????????
???
(?)?
??????????????IP?,???????????????????,?,???????????,??????????????????????
(?)?????
2024?11?6??????????11?????16???????????????????????,?3?IP???????????,???????????,????,????????????,???????????????????,?????????????????????????????????????????4.98GB?
???????????
(??????????????)????
???????,??????????22????8??,?????10?????????????????20??,?,????
(?????)????
?????????????5???????????????????????????IP??????????????????????????????,???????????????,???????
(???????????????????????????)????????????????
??????????????????????????,???????????????,??
?????????,????,??
(?)?
??,???,???,?????????????????276??????,??????????????????,??????????????????
?????????????????????????IP??
??????????????:??????