?

2024?????????????????????12?????18?,??????CNCERT??????????????????(

????????????

(??????????????)???????????????????

????????????????Exchange?????????2??????????????Exchange???????????????????????,?????,??????,???????????????????????????

(?)???????????????????

?????????,?2????????,??????,??????????????,???/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,???????????????????????????,?,????????????

(??????)???????????????????30????

???????????????????,????????,?,?SSH?SMB??????????30??????????????????????????;??,???????????????????????????????????????????????????????????????????????????,?websocket+SSH??????????,?????????????????,??WeChatxxxxxxxx.exe??????2??PIPE?,?????????????????????????

?????????????????

(?)?

?,???????????,???????????????????????,????,????,???????????

(?)???????????

??????????3?,?????????,2023???????????5?2????????,?(95.179.XX.XX)??,?,?????,?????,????????????????“????????”?“?????????????????”?“????????”?“???????????????(??????????????+?)”?“?????????IP???????????????”?“???????????????”?????

(?)?????????????????????????????????

???????????,????????????????????,2023?7?????26?,??????????????????????????(65.21.XX.XX)?,?????????????????,????????,?,??1.03GB???,??????????“????”?????????“tip4XXXXXXXX.php”?

(????????????)?????

???????????????????????????,????,?,????????????????????????????SSH???????????????,???,???

??????

(?)????????

???,?22?8??????????,?10?20??????????,??????????????????????????????,???

(??????????)?????????

2023?????????????5???????????????????2023??10?,????????????????30??????????????,???????????????????????IP??,???

(?????)??????

????????2??PIPE?????“c:\windows\system32\”???????????????,?.net????,???,??????????????????KB,?TLS????????????????,??????????????https?????????????,?websocket+SSH??????,???

???????????????????????IP?

??????

2024?????????????????12?18??????????????,?????CNCERT???????????????????(

?????????????????????????????

(?)??????

2024?8?19?,?????????????,?/??2024????8????????????????????????21?????????????????????,????/??

(??????????)??????

2024????8???21???????????12??????????????,??????,???????????,??????????????????????,??/xxx/xxxx?flag=syn_user_policy?????????????,???/xxx/xxxStats?

(?????????????????)??????????????????????

2024????11?????????????6???2024??????????11???????????????????????????8??????????????????????????????????2024????????????????????11???16??????????????????????,????????276????????????????????????????????????????????????????

?????????

(??????)?????????????

???????????IP????,???????,???????,??????????????,??

(??????????????)??????????????????

2024??????????11?6?????????????11?16?,???????????3????IP??????????????,?,??????,????????,??,????????????????????????????????????????????????4.98GB?

??????????????????????

(???????)?

????,????????????22??8?????????,???????????????????????10????20????????????????????????,????????????????,??????

(???????)????

???????????5?IP??????????????????????,????,??

(????)?????

?????????,????????????????????????,??

??????,?,???????????????

(???????????????????????????)?????

?,??????????????,??,??276???????????????,???????????,??????????????????

?????????????????????????IP?

????????????:????????????????

??

??:???????????,??????????,??????????????