????:2025-01-18 06:57:23 ??:????
????:??????:?????
?
2024????12?????????????????????18???,????????????????CNCERT??????????(
????????????
(?)???????????????????????
??????????????????????Exchange?????2?Exchange?,??????????,???????????????????,????????
(???????)??
??????????????????????????????,??????????????2??????????????,????,????????????????????????????,?/owa/auth/xxx/xx.aspx?????????????/owa/auth/xxx/yy.aspx,???????????????????????????????????,???,?????
(????????????????)?30????????????
????????????????????????,????,???????????,????????????????SSH?SMB???????????????????????????30??????????????????????????????????????????;?????,??????????????????????????????????????????????????,??????????????websocket+SSH?,????,?????????WeChatxxxxxxxx.exe???????????2?PIPE????????????????????,????????????????
???????????????
(?????????????????????)??
?,????????,?,?????,????,??
(?)?
???????3???,??????,2023???????????5??????2??,?(95.179.XX.XX)?????????,?,??????????,???????,???????????????????????????????????(??????????????????????+????????)?????IP?????????????????????????????????
(?)???????????????????
?????????,?????????,2023?????????7?26?????????????????????????????????,??????(65.21.XX.XX)?,????????????????????????,??????,???????????,??????????????????????????1.03GB??,?????????????????????????tip4XXXXXXXX.php?
(?)?
????,?,?,?????????????????????????????????????SSH????????,??,?????????
????????????????
(??)?
?,????????????22?????????8??,??????????????10?????20???????????????????????????,??????,??
(?????????????)?????
2023???????????????5???????????2023???????????????10?,???????????????30?????,??IP?,????????????????????
(??)?
???2?PIPE?????c:\windows\system32\?,???????????????.net??????????????,?????????,??????KB,??????????????TLS????????????????????????????????????????????,??????????????????https?????????,?websocket+SSH?????,???????????
??????????????????????????IP??????
??????????????
2024???12?18????,????CNCERT?(
????????????
(????????)???????????????
2024??8?????????????19?,????,?????/???????????????????????2024????8????????????21???????????????????????,????????????/????????????
(???????????????)?
2024????????8?21?12?????????????,?????????????,?????????????????,????,?/xxx/xxxx?flag=syn_user_policy???,?????????/xxx/xxxStats?
(???????)?
2024?11???????6???????????????????2024??????????11?8??????????????2024????11?16???????????????????,?????????276??????????????????????????????????????????????????????
????????
(??????????)??
??????IP?????,???????????????,??,?,??????????
(????)?????????????
2024????11???????????6??????11??????????????????????????16??????????????????????????????????,????????3???????????????IP?,????,?,??????,??????,??????????????????????????????????4.98GB?
????????????????????
(?)?
??,????????????????????22?????8?,???????????????????????????10???????20??????????,???????????????,????????
(?????)???????
??????????5??????????????IP?????,?,?????
(??????????)??
??????,????,?????????????????????????????
????????????????,?,????????????
(?????????????????)????????
??????????????,?,??????????????????????,??276????????????????,???????????????????????,????????????????????
??????????????????????????IP??????????????
?????:?????????????