??�??????�

????:????????:??????

2024?12??????18?,????????????CNCERT??????????????(

???????????????

(????)??????

?Exchange????????????????2?Exchange??,?????????????????,??,??????

(?)?

??????????????,?2???????,?,????????????????????????????????,??????????????????????/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,??????????????????????????????????????????????,???,?????????????

(??)??????????30?

?????????,??????????????,??????????????,?SSH?SMB????????????30???????????????????????????????;??????????????????????,????????????????????????????????????????,??????????websocket+SSH???????????????,???????????????????????????????,?WeChatxxxxxxxx.exe???????????????2??????????PIPE??????????,??

????????????????????

(?????????)?

??????????????????????,????????????????????????,?????,?,??????????????,?????????

(????????????????????????)??????????

??????3??,???????????????????,2023??????????????5???????2????,?(95.179.XX.XX)?,???????????????,???????????,??????????????????,????????????????�?�?�?�?�??????�?�?????(????????+????????????????????????)�?�????????IP????�?�????�???????????

(??????????????????????)?????????????????????

???????????????????,?????????????????????????????????,2023??????????7?26?,???????????(65.21.XX.XX)?,?,?,????????,?1.03GB??,???????????????????�?????????????�??????�tip4XXXXXXXX.php�?

(?)??????

?????????????????,??,??,???????????????????????????????????????????????????SSH?,????,?????????

??????

(????????)????

?,?22???????????8???????????????????,??10??????????????20???????????????,?,??????????????

(?????????????????)?????????

2023????5??2023???10??????????????????????????,????30?,?IP??????????????,?????????????????

(??????????)??

?2?PIPE????????????????????????????�c:\windows\system32\�???????,?????.net?????,???????,????????????KB,??????????TLS?????????????????????????????,?????????????https??????,?websocket+SSH??,??????

?????IP?

2024????????12?????18????,?????????????CNCERT??(

??????????????????????????

(???????????)???????????????????????????

2024????????????8????19?????,???????????,??????????????????????????????/???2024?8????????????????????21???????????????,??????????????/????????????

(??????)?????????????

2024?8??????21??????????????????12???,???,?????,???????????????,?????/xxx/xxxx?flag=syn_user_policy??????????????????????????????????,?????/xxx/xxxStats?

(?????????)????

2024?????????????11??????6??????????2024??????????????????????????????????11???????????????8????2024????????????11?16?,??276??????????????????????????

????????????

(???????)?

?IP?????,?,???????????????,?,?????

(?)?

2024????????????????11???????????6??????11????16????????????????,???????????????3?IP?,????,?,????????????????????????????,??,?????????4.98GB?

?????????????????????????

(?)???????????????

??????,???22??????????????8???????????,???????????????????????????10????20???????????????????????,???????????,???????????????

(??)??????????????????

?5???????IP???????????????????,???????????????????????,????????????????????

(?)?

????????????????????????????,???????????,??