??
??????????????
2024???12?????????????18?,??????CNCERT?(
??????????????????????????????????
(??????????????????????)??????????????
???????????Exchange??????????????????2?Exchange???????????????,???????????????????????????,?,?????????
(?)????
???????????,???????????????????2???????????????,???????????????????,????????,??????????/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,?????????????????????????????,????,????????????????????????
(?????????????)??30????
??,??????????????????,????????,?SSH?SMB???30??????????;????????????????,??????????????????????????????????????????????????,?websocket+SSH????,???????????????????????????,?WeChatxxxxxxxx.exe???????????????????????????????????2??????????????PIPE??????????????,??????????????????
?????????
(???)?????????????????????????????????
??????,????????????????????????,????????????,????,????,??
(?)?
??????3????,?????????????????????????????????????,2023?5????2??????????????,???????????(95.179.XX.XX)?,????,????????????,???????????,?�????�?�????????????�?�?�?�?(?+?????????)�?�????????????????????????IP??�?�??????????�??
(???????????)??
????,????????????????????????????????,2023????????????????????7??????????????????????26????????????,???????(65.21.XX.XX)??,????????????????????????????,???????,?????,????????1.03GB??,?????�?�????�tip4XXXXXXXX.php�?
(??)??????????
????,??????????,???????????????,???????????????SSH???,?,??
??????????????????????????????????????????
(?)????????????
??????????????????????????,?????22?????????8?,??????10?20???????????????????,?????????,??????
(??????)???????
2023??????5??????????2023?????10?,?30????????,?IP?????????????,????????????????????????
(??)?
????????????????????????2???????????PIPE??????????�c:\windows\system32\�?,???.net?????????????????,??????????????????????,????????????????KB,??TLS????????????????????????????????????????????,????????????https???????,???????????????????????????websocket+SSH??,??
???IP??????
????????????????????????????
2024?12?18????,?CNCERT????????????????(
???????????????
(??????????????)?
2024?????????8?19??????????????,?????????,????????/??2024??????????????????????????8???????????????????21?????,??/???
(???????????????????????????)???????????????
2024???????8???????????????21??????????12??????,?????????????,??????????????,?????????????????,?????/xxx/xxxx?flag=syn_user_policy???????????,?????????????/xxx/xxxStats?
(??????)??????????????
2024?????????11????6????????????????2024????11?????????????????????8????2024??????????11??16?????????????????,???????276?????????????????????????????
????
(?????????????)?
??????????IP????????????????,???????,?,???????????,???????????????
(?????)?????????????????
2024?11???????????????6?11????16????,?3??????????????IP??????????????????????,???????,????????????????,????????????????????????,?????,??????????????????????4.98GB?
???????????????????????
(??)????????????
?,????????????????????22?8???????????????????????????,?10?20?,?,???
(?)????????
?5?IP??,??,??
(??????????)?????????
????,??????,???????
????,???????????????????????,????????????
(???)??????
?,???????????,????????,?276?,????????????????,?????????????????
???????????????IP???????????
????????:?????????????
????????????????????!??????????????????????????????