?????????????????!???????????????

????:????????:??????????

?????

2024???????????????12?18???,????CNCERT???????????(

???????????

(???????????????????????????)??????????????????????????

??????????Exchange?????????????????????????????????????2?Exchange???????,??????????????????????,???????????,??

(?????????????)??

?????,??????????????????2?????,???????????,???????????????,??????????????????????/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,?????????????????,???,?????????????

(????????????)?30???????????

???????,??????????,????,?SSH?SMB?30?????????????????????;?,???????????????????????????????,??????websocket+SSH??????,????????????????????,????????WeChatxxxxxxxx.exe??2????PIPE???????????,????????????

????

(???????)?????????

?,???????????,????,????????,????????????,???????????????

(????)?

?????????????????????3?,?????????,2023?5????????2????,??????????????(95.179.XX.XX)???????,??????,??????,??????,????“?????????????”?“??????????????”?“????”?“???????????????????????(?+??)”?“???????????????IP??”?“????????”???????????

(????)???

?????????????,????????????????,2023???????????????????????????7???????????????????26???????????,?(65.21.XX.XX)??????????,????,??????????????,??,??????????????????????????????1.03GB????????????????????????????,?????????????“?????????????????”??????????????“tip4XXXXXXXX.php”?

(???)?

?,?????????,????????????????????,????????????????????????SSH??????????????????????,??????????,???

????????????????????????????

(?)????????????

??,????????????????22?????????????8???????????????????,?10???????20?????,???????????????????,??

(?)????????????????????????

2023????5???????????????2023??????????????????10??,???????????????30?????????????,???????????????IP?,??????????????????

(?????????????)??????

??????????????2??????????????????????PIPE?“c:\windows\system32\”???,??????????.net??????????????????????????,??,?????????????????KB,?TLS?????????????????????????????????????????????????????????????????,?????https?,???????websocket+SSH???????????????,???????????

????????IP??????????

????????????????

2024?12?18???,?CNCERT?????????(

??????????

(?)?

2024?8??????????????19?,???,?/??2024??????????8?21????,???????????/?????

(????????????????????????????)?

2024???????????????????????8???????????????????21?12?,???????????????,???????????,??????????,?/xxx/xxxx?flag=syn_user_policy??,?/xxx/xxxStats?

(??)??????

2024????11???????????????6??????????2024???????????????11??????8?2024?11????????????????????????16??,?276?????????????????????????????????????????????????????????????????

???????????????

(???????????????)?

?????????????????????????????????IP??????????????,???????,??,??????????????,??

(????)?

2024??????????????11????????????6??????11????????16??????????????,??????3???????????????????IP????????????????,??????????????????????????????????,????,??????????????????????????????,?,??????????????????????????????????4.98GB?

?????????????

(????)??????????

????????????,?22????8?,?????10?20?,?,?????

(???)???????

?5?????????IP????????,??????,???

(?)??

?,???????????????,???????

?????,?,??????

(?????????)?

????,??????????????????,?????????????????,????????????????276?,???,??????????????????????????????????????

?????????????????????IP????????????????????????????

??????:??