????:1??????:??????

2???????????

3??????????

4?????wx

5???????

???????

2024??12??????????????????????????????????18??,??????????CNCERT?(

???

(????)?????????

?Exchange??????????2?Exchange?????????,????,??,????????????

(?)?????????????????

??????????????,?2???????,?,???????????????????,??/owa/auth/xxx/xx.aspx???????????/owa/auth/xxx/yy.aspx,??????????????,??????????????,???

(?)??????????????30??

?????????????,???????????,??????,?SSH?SMB???????????????????30????????????;?????????????,????????????????????????????????????,?websocket+SSH?????????,????????,?????????????????????????????????WeChatxxxxxxxx.exe??2?????????????????PIPE??????????????,??

??????????????????????????

(??????????)??????

?????,??????????????????,?????,?,?,???

(?????????????)????????

??????????????3????,??????????,2023??5??????????????????2?????????????????,????(95.179.XX.XX)?????,???????????????????,????,?????????,?“????”?“????”?“???”?“???????????????????(???+??????)”?“??????????????????IP????”?“??????????????”?????????

(????????????)????????????

???????????????????????????????????,???????????????,2023??????????7?26????????????????,???????????????????(65.21.XX.XX)???????????,?,????????????,?????????????,???????????????????1.03GB?????,?“??????????????????????”????“tip4XXXXXXXX.php”?

(?)?

?,???????????????,?????????,???????????????????????SSH?,???????????,??

????????????????????????????????????

(??????)?

???????,?22???????????8?,?10??????????20???????,????????????????????,???

(????????????)????

2023???5??????2023?10????,?30?????????????,???????IP???????????????,??

(??????????????????????????????)??????????????????????

????????????????????????????2???????????????PIPE???????????“c:\windows\system32\”?,????????????????.net?,??????????,???KB,?????????????????????TLS??????????????????????????,??????????https??????,?????????????????websocket+SSH???????????????,???????????????

???????IP?

?????

2024??????????12?18??,?CNCERT???????????????????????????(

??????

(????????????????????????)???????????????????????????

2024???8??19?,??????????,?????/??????????2024??????????????8???????21?,??????/?????????????????????????

(????????????????????????????)??????????????????????

2024????????????8?21?????????????12???,???????????????,???????????????????,?????????,???/xxx/xxxx?flag=syn_user_policy???????????,????/xxx/xxxStats?

(???????????????????)?

2024????????11????????????????????????6??2024??????????????????????????11???????8??????2024?????????11????????????????????16?,????????????????276??????????????????????????????????

????????????????????

(??????????????)??????????

???????IP???????????,?,???????????????,?,??

(?)??

2024??????????????11????????6???????????????????????????11??????16??,?3???????????????IP??????????????,?????,????,???????????????????????,????,????????????????????4.98GB?

?????????????

(???????????????)??

?????????????????,?22?????8?????,?10?20???,??????????????,????????????????????????

(??????)???????????????

?5??IP????,??????,??????

(?)???????????????

??,???????????????????????????????????,?????????

??,?,??????????

(??????????????????)???

?,?,???????????,?????????????276???????????????????????,????????????????????????????????,??????????

??????????????????IP??????

???????????????:??????