?

2024??????12??????18????,??????CNCERT?(

??????????????????????????????????????????????????????????????

(???????)?????????????????

??????????Exchange????????????2??????Exchange?,?????,??????,????????????????

(??????????????????????????????)??????????????

?,?2??????????,??,???,??????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????????????????????,????????????,????????

(?)???????????30?

?????,???????????,??????????,?????SSH?SMB????????30?????;?,?????????????????????????????????????????????????????????????????????????????????????,????websocket+SSH??,????????????????,???????????WeChatxxxxxxxx.exe???????2?????????PIPE?,???????

????????

(??????????????)?

????,???????????????????????????,??????????????,????????????????,?????,??

(?????????)??

??3???????????????????????????,?????????????????????????????,2023????5???2?,???????????????(95.179.XX.XX)?,?????????????????,?????????????,?,???????????????????????“?”?“???????????”?“?”?“?????????????????????(?+??????????????????????)”?“?????IP???????????????????”?“????????????”??

(????????)??

?????,???????????????????,2023???????????????????7???????????????????????26?,????(65.21.XX.XX)??????????????,?????,????????????????,??????????????????????,???????1.03GB??,?????????????“???????”??????“tip4XXXXXXXX.php”?

(???????????)??????????????????

??????????????????????????,????,??????????,?????????????????????????SSH???????,?????,??????????

???

(?)?

???????????,???????????22?8??????????????????????????????????,???10??????20????,?????????,??????????

(????)????

2023????5??????2023???????????????10????,?????30???,????????????IP?????????????,???????????????

(??????????????)????

?2???PIPE??????“c:\windows\system32\”?,?????????.net????????,?,??????????KB,?TLS?????????????????,???????????????????????????https?,?websocket+SSH?,???????????

???????????IP?

???????????????

2024?????????????12???????18??????????????????????,?????????????????CNCERT?(

???????????????????????????

(?)???????????????????????????

2024??8???????????????19????,???????????????????,???????????????????/??2024???????8??????????????21???,??????????/??

(?)????

2024?8???????????21??????????????????12????????????,????????,????????????????????????????,?????????????????,???????????????????????/xxx/xxxx?flag=syn_user_policy?????????????,??????/xxx/xxxStats?

(????????)????????????

2024????11??????????????????6???????????????2024???????????????????????11?8???????????????????????????2024?11??16?,??????????????276???????????????????????????????????????????????????????????

?????????????????????

(??????????????)?????

??????IP????????,????,???????????????,??????????????,????????

(?)?

2024????11????6?????????????11?????????????????????16?,?3????????????IP?,???????????????????,???????????????,????????????,?,??????????????4.98GB?

?????

(??)?????

??????????????????????????,?22?8?,??10????20???????????????,????,???????

(?????)??????

??????????5???????????IP?????????,???????????????,????????????????????

(?????????????)????

???????????????????,???????????????,??????

?,??????????,????????

(?)?

????????,???,??,??????????276?,???,????????

?????????????IP????????????????????????

???????????????????????:?????????

??

??:???????????,??????????,??????????????