?????????????????!???????????????

??????????

2024?12?18???????????????????????????,?????????CNCERT?????(

???????????????????

(?)?????

???????????????Exchange????????2?Exchange?????,?,?????????????????????????????????,?????

(??????????)?

?????????,??2?,?????????????????,???????????,?/owa/auth/xxx/xx.aspx????????????/owa/auth/xxx/yy.aspx,?????????????????,???,??????????

(??)?????30??????????????????????

????,?,??????,?SSH?SMB?30?????????????????????????????????;??,?????????????????????????????????????????????????,???????websocket+SSH???????????????????,???????????????,?WeChatxxxxxxxx.exe????????????????????2????????PIPE???????????????????????????,??

?????????????

(??????????????????)????

???????????,????????????????????????????????????,?,??????????????,?,???

(???????)??

???????????3????,??????????????,2023???????????????????????????5?????????????2???????,????(95.179.XX.XX)??????????,??????????????,?????????,????????,???????????“?”?“?????”?“??????????????”?“?????????(??????????????+?)”?“???IP??”?“?”????????????

(???????)??

??????????????,?????????,2023?7??????????????26???????????????,??????(65.21.XX.XX)?,??,?,??????????????????????????,??????????1.03GB?????????????,???????????“???????”???“tip4XXXXXXXX.php”?

(?)??????????????????????????????????

???????????????????????,?????,????????????????????????????,?????????????????????????????SSH????,?????????????????,???????

??????????????????

(?)?

?????????????????,????22??????8?????????,??????????????10??????????????????????????????20?,??????????????,????????????????????

(??????????????????????)??????????????????

2023????????????????5?2023???????????10?,?30?,?IP??,??????????????????????

(???????????????)?

??????2????????????PIPE???????????????????????????“c:\windows\system32\”????,?.net???????????,????????????????????????????,??KB,?TLS??????????????????????????????????????????????????,??https?,??????websocket+SSH????,????????????

??????????????????????????????IP???????????????

??????????

2024????????????12??????????????18??,?????????CNCERT?(

???????????????

(??)?

2024????????????????????????8??????19??????????????,????,??????/????????2024???????????????????8????????????????21??????,??????????????????????/???????????

(??)???????????????????????

2024?8??????21???????????????12??????????,???????????,????????,??????????????????????????????????????,?/xxx/xxxx?flag=syn_user_policy?????????,??????????????????????/xxx/xxxStats?

(???????????)?????

2024???11?6???????2024?????????????11??????????8????2024???11?16??,??????????276????????????????????????????????

??????????????????????

(???????????????)?

????IP?,?,??????????????????????????,?,?????

(????)????????????

2024?11?6???11?16????,?3???????IP?,?????????,?????,??????????????????????????????????,????,??????????????????4.98GB?

????????????

(?)????

??????,?22??????????8??,?????10?20??????,????,?????

(?????)??????????????

???????5????????????????????IP?????????????,????????????????????,??

(?)??????????????

??????,??????????????????????????????,??

?,?????,??????

(????????)???????????????????

???,?,???????????????,?276?????????????,????????????????????,???????????????????????

???????????????IP???????????????????????