?????????????????!???????????????

????????????????

2024??????????????????????12????18??????,?CNCERT????????(

???????

(??????????????)??????

??????????????Exchange??????????????????????????????????2??Exchange????,??????????????????????,??????????,??????????????????????

(?)?????????????

?,???????????????????????2?,????,?????????????,??????????/owa/auth/xxx/xx.aspx???????????????????/owa/auth/xxx/yy.aspx,?????????????????????,??,???????????????????????????

(???????)????????????30??????????????

????????????????????,?????????????????,?,?SSH?SMB???????????????30???????????????????????????????????????????;???,??????????????????????????????????????????????????????????,????websocket+SSH?,????????????,?WeChatxxxxxxxx.exe???????????2??????PIPE??,???????????

??????????????

(?)?????????????

??,????????????????????,?????????,?????,???,?????

(??????????????????????)?????

???????????3?,???,2023?5???????????????????2????,?????(95.179.XX.XX)???????????,??????????????,??????,??????????????????????,?“?”?“????????????????”?“?”?“??????(?+???????)”?“??????????????IP?????”?“?”?????

(???????????????????????)???????????

??????????,??????????????????????????????????,2023?????????????????7????????????????26??????????,??(65.21.XX.XX)??????????,????????????????,?????????????????????????????????,?????????????,?1.03GB???,????“???????”???????????????“tip4XXXXXXXX.php”?

(??????????????????)???

?,????,?????????????,?????????????????SSH?????????,??????,??????

??????

(?????)??????????????????????????????

???????????,?22?8?????????????????,?10????20????,??,???????????

(?)?

2023?????????????????5????????2023??10???????????????????????,???????????30?????????????????,??????????????IP???????????,??????????

(???????????????????????????)?

?2???PIPE?“c:\windows\system32\”?????????????,?.net???,????,???????????KB,?????????????????????TLS????????????????????????????????????????????????????????,??https?????,???????websocket+SSH??????,?????

????????IP?

?????????

2024?12??????????18??????,?CNCERT??(

???

(??????????????????????????????????)????????????????????????

2024??8???19????,?,??????/?????????2024???????????8?21???,???????/??

(?)?

2024?????????????8?21??????12?,????????,?????????,????????????????????????,?/xxx/xxxx?flag=syn_user_policy?????????,????????????????????????/xxx/xxxStats?

(?)?

2024??????????11????????????????????????????6?????????????????????2024??????????11????8??2024?11??16??????????,???????????????????????276???????????????????

?????????????????

(????????????????)????????

?IP??????????????,???????????????,??????????????,?,??

(???????????????)????????????

2024???????????????????????????11??????????????6?????11?16????????????,???????????3??????????????IP????????????,????????,???????????????,??????,????????,??????????????????????????????????????????4.98GB?

????

(???????????????)????????????

?????????????,?????22?8??????????????,?10?????20?????,??????????????,??

(?)???????????????????

??????????????5?IP?,?????????,???????????????????

(??????????????)?????

?????,??????,?????????????

?????????,??????,??

(?????)????????

???????,??????,???????????????,?276???????????????????,??????,????????????????

????????IP??