?????????????????!???????????????

??

?

2024?12??????18??????????????????????,?CNCERT??????????(

????????????

(??)???????????????????????

??????????Exchange???????????????2??????????????????????????????Exchange?????????????,????????????????????????,?,??

(?)?

?????????,???????????2????,??????,?????????????????,???????????/owa/auth/xxx/xx.aspx?????/owa/auth/xxx/yy.aspx,????????,??????????????????,???????

(????)??30?

?????,???????????????????,??????????????????,??SSH?SMB???????30???????;?,?????????????????????????????????????????????????????????,?????websocket+SSH??????????????????????,??????????,???WeChatxxxxxxxx.exe??2?PIPE????????????,??

???

(??)?????

????????????????,????????????????????,????,????,??????????,??

(???????????)???????????????

??????????3???????????,???????????????????????????,2023??5?????2??????????????????????????,??????????(95.179.XX.XX)???????????????????,????,??????????????,???????????????????????????,??“???????????????”?“?”?“?????”?“??????????????????????(????+?????)”?“???????????????IP??????????”?“???????????”??????????

(???????)??

????????,??????????????????????????????,2023?????????7????26???????????,???????????????????????(65.21.XX.XX)?????,???????,?,??????,???????????????????????1.03GB??,?“?”?“tip4XXXXXXXX.php”?

(????)????????????????????????

????????,??????,?,??????????????????????????SSH?????????????????????,?,???

???????????????

(??????????)????????

??????????????,??????22??????????????8?,?10????????????20?,????????,???

(?)????????????????

2023???????????????5??????????????2023???????????????????10????,?????????30??????,????????????????IP???????????????????,???

(?????)??????

??2???????????PIPE??“c:\windows\system32\”??????,?????.net?,?,?????????????KB,????????????????TLS???????????????????????????????,?????????????????????????????????https?,????websocket+SSH?,????

???????????????IP????????????

???????

2024?????????????????????12????18?,??????????????????????CNCERT?(

?????????????

(???????????)???????????????

2024????8????????????????19??,????????????,??????????/?????2024???????????????????????8???????????????????21???????????????????????????,?????/???????

(????????????)??

2024????????8?21??????????????12???,???????????????????????,?,???????,?????????????????/xxx/xxxx?flag=syn_user_policy??,?????????/xxx/xxxStats?

(???????)???????????????

2024??????11???????????6??2024????????????????????????????11?8?????????????2024??11???????16????,????276?????????????????????????????????????????

??????????????????????

(????)???????????????????????????

??????????IP???????,?,??????????????,?,??????????????????

(?????)????????????????????????

2024?11?6?11???16????,?3?IP?,????,?,???????????????????????????????,??,????????????????????????????????????4.98GB?

??????????????????????????

(??????)?

??????,???22?8?,????????????????????????????10?????????20?,?,??

(????????)??????????????????

????5??????????????IP?????????,???,?????????????????????

(??????????)???????????????

?,?????????????,?????????

???????????????????????????,?,????????????????

(?)???????

?,??????????,??????????????????????????????????,?????????????276?,????????????????????????????,??????????????????

???????????????IP???????????

??:??????????????????

?????????

??????????????????????!????????????????????

????????