????????????????????????????

2024??????12???????????18?,???????????????CNCERT?(

???????????????????????

(??????????????)???????????????

????Exchange????????????????????2??????????Exchange??????????,?,?,?????

(??????)???????????????????

??,?2????????,????,???????????????????,???/owa/auth/xxx/xx.aspx?????????????/owa/auth/xxx/yy.aspx,?????????????????????????,????,?????????

(??????????????????)??????????????????????????????????30?????

??,?????????????????,????,?SSH?SMB??????????30??????????;???????,???????????????????????????????????,????????????????????????websocket+SSH??????,????????,?WeChatxxxxxxxx.exe??????2????PIPE?????????,??????

????

(??????????????????)?

???????????,??????????????????,?,????????????,??,??

(??)???????????????????

????????????????????????3?,??????????????,2023????5????2?,????????(95.179.XX.XX)????,?????,??,??????????,???????????????“??????”?“??????????????”?“???????????????????????????”?“????(?+??????)”?“??????????????IP??????????????????????”?“?????”????????

(????)?????

????????????,?????????????????,2023?7???????????????????????????26?,??????????????????????(65.21.XX.XX)??????????,??????????,????,??,?1.03GB????????????????,?“??????”?????????“tip4XXXXXXXX.php”?

(????????????)????????????????

?,??,??????????????,?????????????????????????????????????SSH??????????????????????,?,??

???????????????????????????

(???????????????)????????????????????

?,?????????22??????????8???????,?????????????10?20??????????,????,???????????

(?????????????????????)?

2023???????????5???????2023?????????10?,???????30??????????????,??????????????IP?????????,?????????

(????????????????????????????)?

?2??????????????????????PIPE?“c:\windows\system32\”??????????????????,?????.net?,????????,????????KB,???????????TLS??????????????????????????????????????????,???????????https?,???????websocket+SSH????,????

??????????????????????????????IP????????????????

??????

2024????????????12??????????????????????????18?,?CNCERT???????????????????(

????????????????????????????

(?????)?

2024???????8?19????,??????,?/???????2024????????8???????????????21?,????????????/??

(??????????????)???????????????????

2024????8???????????????????????21?12????,?????,?,??????????????????????,??????????????/xxx/xxxx?flag=syn_user_policy??????????????????,?????/xxx/xxxStats?

(?)???????????

2024?11?6?????????????2024?????????????????????????????????11?????????????????8?2024?11???????????????????16???????????,??276??????????????

???

(?)?

??????????????IP?,???????????????????,?,???????????,??????????????????????

(?)?????

2024?11?6??????????11?????16???????????????????????,?3?IP???????????,???????????,????,????????????,???????????????????,?????????????????????????????????????????4.98GB?

???????????

(??????????????)????

???????,??????????22????8??,?????10?????????????????20??,?,????

(?????)????

?????????????5???????????????????????????IP??????????????????????????????,???????????????,???????

(???????????????????????????)????????????????

??????????????????????????,???????????????,??

?????????,????,??

(?)?

??,???,???,?????????????????276??????,??????????????????,??????????????????

?????????????????????????IP??

??????????????:?????? ??“???98?”????

?? ?????????????????!???????????????

????:1????98?:??????

2???????????

3???????

4??????????

5?????wx

????????????????????????????

2024??????12???????????18?,???????????????CNCERT?(

???????????????????????

(??????????????)???????????????

????Exchange????????????????????2??????????Exchange??????????,?,?,?????

(??????)???????????????????

??,?2????????,????,???????????????????,???/owa/auth/xxx/xx.aspx?????????????/owa/auth/xxx/yy.aspx,?????????????????????????,????,?????????

(??????????????????)??????????????????????????????????30?????

??,?????????????????,????,?SSH?SMB??????????30??????????;???????,???????????????????????????????????,????????????????????????websocket+SSH??????,????????,?WeChatxxxxxxxx.exe??????2????PIPE?????????,??????

????

(??????????????????)?

???????????,??????????????????,?,????????????,??,??

(??)???????????????????

????????????????????????3?,??????????????,2023????5????2?,????????(95.179.XX.XX)????,?????,??,??????????,???????????????“??????”?“??????????????”?“???????????????????????????”?“????(?+??????)”?“??????????????IP??????????????????????”?“?????”????????

(????)?????

????????????,?????????????????,2023?7???????????????????????????26?,??????????????????????(65.21.XX.XX)??????????,??????????,????,??,?1.03GB????????????????,?“??????”?????????“tip4XXXXXXXX.php”?

(????????????)????????????????

?,??,??????????????,?????????????????????????????????????SSH??????????????????????,?,??

???????????????????????????

(???????????????)????????????????????

?,?????????22??????????8???????,?????????????10?20??????????,????,???????????

(?????????????????????)?

2023???????????5???????2023?????????10?,???????30??????????????,??????????????IP?????????,?????????

(????????????????????????????)?

?2??????????????????????PIPE?“c:\windows\system32\”??????????????????,?????.net?,????????,????????KB,???????????TLS??????????????????????????????????????????,???????????https?,???????websocket+SSH????,????

??????????????????????????????IP????????????????

??????

2024????????????12??????????????????????????18?,?CNCERT???????????????????(

????????????????????????????

(?????)?

2024???????8?19????,??????,?/???????2024????????8???????????????21?,????????????/??

(??????????????)???????????????????

2024????8???????????????????????21?12????,?????,?,??????????????????????,??????????????/xxx/xxxx?flag=syn_user_policy??????????????????,?????/xxx/xxxStats?

(?)???????????

2024?11?6?????????????2024?????????????????????????????????11?????????????????8?2024?11???????????????????16???????????,??276??????????????

???

(?)?

??????????????IP?,???????????????????,?,???????????,??????????????????????

(?)?????

2024?11?6??????????11?????16???????????????????????,?3?IP???????????,???????????,????,????????????,???????????????????,?????????????????????????????????????????4.98GB?

???????????

(??????????????)????

???????,??????????22????8??,?????10?????????????????20??,?,????

(?????)????

?????????????5???????????????????????????IP??????????????????????????????,???????????????,???????

(???????????????????????????)????????????????

??????????????????????????,???????????????,??

?????????,????,??

(?)?

??,???,???,?????????????????276??????,??????????????????,??????????????????

?????????????????????????IP??

??????????????:??????