?????????????????!???????????????

???

2024????????????12?18????,???CNCERT???????????????????????????(

??????????????

(???????????????)???????

??????????????????????Exchange??????2??????????Exchange?,??????????????,????,?????

(???????????????????)??????

??????,?2???????????????????????,??,????????????????????????????????,????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????????????????????,??,??????

(?)??????????30???????????????

???????,?????,?????,?????????????SSH?SMB??????30???????????????????;?,??????????????????????????????????????????????????????????????,??????????????????????????websocket+SSH?,????????????????????????????????,???????????????????WeChatxxxxxxxx.exe??2??????????????????PIPE??????????,???????????????

????????????

(??)?????

?????????????????,?????????,????????????????????????,?,?,??

(?)????

?3?,?????????,2023??5?????????????2?,?(95.179.XX.XX)???????????,????????,?,?????,?“?”?“???????”?“????”?“????(?????????+?)”?“???????????????????IP??????????”?“?”?????

(???????)??????????

?????????????????,??????????,2023????????7??????????????26??????,?????????(65.21.XX.XX)????????????????????????????,??????,???????????????,??????????????????????????????????,???????????????????1.03GB????????????,???????????????“?”??????????“tip4XXXXXXXX.php”?

(???????????)???????????????????????

????????????????,?,?,???????????????????SSH??,??,??

??????

(????????????)????

????,??????22?????????8?,??????10?20??????????,?????,???????????????

(????????????)??????

2023??????5???????2023????10?,??????????????30??,???????????IP?????????,???

(???????)?

????2???PIPE?????????????????“c:\windows\system32\”???????????????,?.net?,??????????????,??????????????KB,?TLS??????????????????????????????????????,?https?????,???????websocket+SSH???????????,???????

????????????IP????????????

?

2024?????????????12????????18?,???????????????????CNCERT???????????????????????(

?????????????????

(?????????????????)?????????????????

2024???????????????????????????8??????????????????????????????19????????????????????,??,?????????????/????2024?8?????21?????,?????????????/??

(????????????)?????????

2024??8??????????????21??????????12??,????????????????,????????????????????????????,??????????????????????????????????????,?/xxx/xxxx?flag=syn_user_policy????????????????,?????????/xxx/xxxStats?

(??????)??????

2024???11???????????6????????????????????????????2024??????????????????????????11?????8??????2024??11????????????16?????????????????????,????????????????????276???????????????????????

????????????????????

(???????????????????????????)??????

?IP?,?????????????????????,????????,??????????????,?????

(???????????)??????????

2024?????????????11?????6?????????????????????????????????11?16??????????????,??????????????????3??????????????IP?,?,?,?????????,???????????,?????????????????????????????????4.98GB?

???

(?)??

????,?????????????22?????8?,??????10??????????20??????????????????,?,?????????????????????????

(???)???

?5???????????IP??????????,?,??

(?)???????????????

??,??????????,??

?????????????,???????,??

(???????????????????????)????????????????

????,?,?,????????276???????,????????????????????????????????,????????

?????????????IP????????????????????????

??:??????