????

2024?????????????12?????18??????????????,???????????????????????????CNCERT?(

????????????????????

(????)??????????????

????Exchange??????????????2?????????????Exchange????????,?,?,?????

(??????????????????????)???????????

?????????????,?2?,?????????,????,?????/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,??????????????????????????,?????????,????

(?)???????????????????????????30???????????????????????????

?,??????,??????,?SSH?SMB?30??????????????????????????????????;????,??????????????????????????????????????????????????????????????????????????,????websocket+SSH??????????????????,????????????????,????WeChatxxxxxxxx.exe??????2?PIPE??????????,?????

????????????????

(???????)?

?,???????????????????????????????????,????,??,???,????????????????

(?)?

???3????????????????????,??????????????????????????,2023??????????????????????????????5????2??????,????(95.179.XX.XX)?,???????????????????,????,???????????????,???????????“?”?“?”?“?????????”?“???????????????????????(???+???????????????????)”?“????????????IP??”?“??????”?????

(????)??

?????????,???????????????????????????????,2023??????????????????7?????26???????????????,???????????(65.21.XX.XX)????????,?,?,?,?????1.03GB???,??????????????????????????“???????????”?“tip4XXXXXXXX.php”?

(???????????????????????)??????????

?,?????????????????????,?,??????????????????????????????????????????SSH??,??,???????????????

??????????????

(?????)??

?????????????????,????22?8??,?10??????????20???????,???????????????,??

(?)???????????????????

2023??5???2023??10?????????????,?30????????????????????????,?IP??????????????,???

(????????)?

?????2?PIPE?“c:\windows\system32\”???????????????,?.net???????????????,???,?KB,??TLS????????????????????????????????????????????????????????????????????????,??????????https????????????????????????????,???????????????websocket+SSH????????????????????????,??

????IP??????????????

??????????

2024?????????12?18?,?CNCERT?(

?????????????????

(?)???????????????????

2024?8?????19?,?,?/????2024????8????21????????????????,???????/?????

(????????????????????)??????????????

2024?????8??21??????12??????????????,???????????????,?,????????????????????????????,?????????????????????????????????/xxx/xxxx?flag=syn_user_policy??,??????????/xxx/xxxStats?

(??????????)??????

2024??????????11???????????6??2024?????????????????11?8?????2024?11??????16??????????????????????,?????????276??????????????????????

????????????????????

(????????????????????????)????????

??????????IP?,???,???????????????,??????,????????

(?)???????

2024?11?????6?11??????16??????????????,???????3?IP?,?,????????????????,???????,???????????????,??????????????????????????????????????????4.98GB?

????????????????????????????

(?)?

???????,?????????????22??????8?,???????????????????10????????????????20??????,????????????,???????????????

(?)????????????????

???????????5????IP????????????,?,?????

(???????)??????

?????,??????????????????????,????

??????????????????????????,?????????????????,???????????

(?)?

????,?????????????,????????,???????????????????????276????????,????????????????,?????????????

????????????????????IP???????????

?????????????????????????????:??????????????????????

??

??:???????????,??????????,??????????????