?????????????????!???????????????

?

2024??????????12?????????????????????18?,?CNCERT?????????????(

??????

(?)????

?Exchange???????????????????????????????2??Exchange?,?,?????????????????,???????????????????????

(?????)????????

?????????????,????????????????????2?????????????,??,????????????????,???????????????/owa/auth/xxx/xx.aspx?????????????????/owa/auth/xxx/yy.aspx,??????????????????????????????,???????????,??????

(??????????????)?????????30?????????????

??????????,????,?,???????SSH?SMB??????30????????????????????????????????????????????????;????,?????????????????????????????????????????????????,?websocket+SSH??????????????,????????????????????,??????????????WeChatxxxxxxxx.exe?????2?PIPE?,??????

???????????????????????????

(??????????)????

??,???????,?,??????,????????,??

(????????????)????????????????????????

??3??,?????????????,2023????5?2?,?(95.179.XX.XX)?????,??????????????,???????????????????????,?,??“??????”?“??????????????”?“??????????????????”?“??????????(???????+?????????????????????????????????)”?“?IP????”?“?????”??

(?)???

???????????,????????????????????????????,2023???????????????????7??????????????26???????????????,?(65.21.XX.XX)?????,??????????????????,????????,?,?1.03GB?????????,????????????“?????????????????”??????“tip4XXXXXXXX.php”?

(???)??????

??????????????????????????????????,?????????,?,????????????????????????SSH????????????????,????,?????????????????

?????????????????????????????

(????????????????)????????????????????????

???????????????????????????,??????????????22?8??????????????????????????,?10???????????????20???????????????????,?,???????????????????????

(?)????

2023?????????????5??????2023?????10???,???30?,???????????????????IP???????????????????????,?????????

(????)??

?2???????PIPE?“c:\windows\system32\”?,???????????.net???????,???????????,???????????????KB,?TLS??????????????????????????????????,???????????https?,?????websocket+SSH????????????,???????

??????????????????????IP????

?????

2024?12??????????18??????????,????CNCERT??(

???????????????????????

(????????)?

2024??8????19????????????,?,???????????????????/??2024?8?????????21???????,????????/???????????

(????)??????????????

2024??????8?????21??12?????????,???????????????,???????,??????????????,??????/xxx/xxxx?flag=syn_user_policy????????????????????,?/xxx/xxxStats?

(??????)??????????

2024???????????????11????????6??2024???????????????????????????11??????8??2024???11?16?????,???276???????????????????????????????????????????????

??????????????????????????????????????

(??)???

??IP?,?,?,????,??????????

(?)?

2024??????????????11???????????????6??????11?16?????,?????3??????????????????????????IP????????????,??????????????,???????????,??????,?,????????????4.98GB?

?????????????????????

(?)???????????

??????????,?22?8?,??????????10????????????????????20?,??,?????

(??????)???????????

???????????????????????????5????????????????IP?,??????,????????????????

(??????????)??????????????????????????????

???????????????????,??????????????????????????????????,?????????????????????????

?,??????????????????,????????????????

(??????????????????????)?

???????????,???????????,????????????????,????276???????,?????????????,?????

????IP???????????????