?????????????????!???????????????

??

?

2024?????12?????18????,?????????????CNCERT?????????(

?????????????????

(???????????????????????????)??????????????

?Exchange???????????????????2??????????????????????Exchange?,???????????????????,??,??

(???????????????????????)??????????

??,?????????????????????????????????2?????????,???????????,???????????????????,??????????????/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,?????????,??????????,??

(????)????????????????????30?

?????,??????????,????,?????????????SSH?SMB?30?????;???????????,???????????????????????????????????????,?websocket+SSH???????????????????????,????????????????????????????,??????????WeChatxxxxxxxx.exe??2????PIPE?,??

???????????????????

(????)??????????????

???????????????????????,??????????????,??,???????????,??????????,???

(??????)?????????????

???????????????????3??????????????,??????????????????????,2023??????5??????????????2????,???????(95.179.XX.XX)?????,????,?????????????????,????????????????????????????,??????????????“???????????”?“??????????????????????”?“????”?“???????????????(?????????+??????)”?“??????????????????????????IP???????????”?“???????????????”??????????????????

(???????????????)??????

???????,??????????,2023?????????7??????26?????,??????????????(65.21.XX.XX)?,????????,?????????????????,??,????1.03GB??????,??“??????????????????????”????“tip4XXXXXXXX.php”?

(?????????????)???

??????,??????????,???????????????????????????,?????????SSH??????????,????????,????

???????

(???????????)?

?,?22?8?,????????????????????????10??20?????????,??????????????????,?????

(??)??????

2023???????????5???????????????2023???????10?,?30?,????????IP??????,??

(???)??????

?2?PIPE??????????????“c:\windows\system32\”?,??????????????????????????????.net???,?,??????????????KB,?TLS?????????????????????????????,?https?,?websocket+SSH????,????????????

?????????????????????IP?????

????

2024??????????????????????????????????12??18????????????,?CNCERT?(

????????????????????????

(????????????????????????????)???????????????

2024????8????????19?,?,?????????????/????????2024?8???21??????,?/??

(????????????????????)?

2024???????8?????????21??12?,???????????????????????????????????????,?????????????,???????,????/xxx/xxxx?flag=syn_user_policy??????????????????????,????????????/xxx/xxxStats?

(???????)??

2024??????11??6???2024??????????11??????????8??????????????????2024?????????????11????????????????16??,????276???????????????????????????????????????????????????????

???????????

(???)???

????????????IP????,?,??,?,??

(?)?????????????????????

2024??????????????????11????????????????6?????????????11??????16???,???????????????????3?????????IP?,?,???????????????,??????????????,???????????????????????????,?????????????????????????????????????????????????????4.98GB?

???????????????

(??)?????

?????,??????22?8?,????10????????????????20??????,?,???????????????

(?)??????????????????????????

????????5??????????IP??????????????,????????????????,??

(??)???????????

?????????,??????????????????????????,??

????????????????????????,????,??

(?)??????????

???????,????,??,???????????????????????276????????????,???????????????????????????,????????????

??????????????IP????????

????????????????????????????:??

?????????

??????????????????????!????????????????????

????????