???????????????!?????????????????

??

???????????????????

2024??12?????????????????18?,?????????CNCERT??????????(

?????????????????

(?)???????????????????????????

????????????Exchange???????????????????????????????????????2????????Exchange?,??,??????????????????????????????,??????????

(????????????????)?

??????,?2??,??????????????,????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????????????????????,?,??

(????)?30??????????????????????

???????????????????????,???????????????,?,???????????????????????????SSH?SMB??????????????30?????????????;???????????,?????????????????????????????????????????????????????????????????????????????????,???websocket+SSH?,?????????,?????????????????????WeChatxxxxxxxx.exe???????????????????????2?PIPE????,????????????????????

??????????????

(?????????????)???????????

????,???,??????,?????,????????,???????

(??????????????????)????????

???????????????3??,????????,2023?????5?????????????????2??????????????????,????(95.179.XX.XX)?,??????????????????????????,?????????????,???????????????,?????????????“??????????????”?“???????”?“????????????”?“????(?????????????+??)”?“???????IP?”?“?”????????????????

(???????????)??????

??????????????????????,??????,2023?7?????????????26????????????????????????????,?(65.21.XX.XX)????,?,?????,?,???????1.03GB???,?“??????????????”????????????“tip4XXXXXXXX.php”?

(?)????

?,?????????,??????,?????????????????????????????????????????????????????SSH????,???????????????????,??????

???

(???)???????????????????????????

?,???????????????????22?????????????????8???,?????????10?20??????????????,?,????????????

(??????????????)??

2023????????????????5???????2023?10?,??????????30?,??????????IP???????????,????????

(?)????????

??2?PIPE??????“c:\windows\system32\”?,??????????????????????????.net????????????????,??????,???????????????????KB,???????????????TLS???????????????????????????????,????????https??,??????websocket+SSH?,??????????

???????????????IP?

???????????????

2024???????????12???18??????,????CNCERT?(

?????????????????????

(???????????????????)??????

2024????????????????????????8??????19??????????,???????????????,????????????/???????2024?????????????????????8?21?????,?????/?????

(????????????????????????????)??????????????

2024??8????????????????21?12?,???????????????????????????,?,??????????????,?/xxx/xxxx?flag=syn_user_policy?????????,?/xxx/xxxStats?

(?????)???????????????

2024????????????????????????11???????6???????????????2024?????11????8???2024???????????????11?16??,???????????276???????????????????

?????????????

(??????????)?

???????????????????????IP???????????,?,?,??????????????,??

(?)??

2024??11???????????????6??????????11???????????16???????,????3?????????IP??????????????????????????????????,????????,????,?????????????,????,????????????????????????????4.98GB?

?????

(????????????????????)????????????

?????????????????,???????????????????????22??????????????????????8?,?????????10??20??????????,????????,???????

(?)????

?????????????5?IP??????????,????,????????????????????????????

(??????????????)?

?,?????????????????,?????

???,??????,??????

(?????????????)?

????,??????????,???????,??276?????????????????,???????,????????????????

????IP??????????????????????

???:??

?????????

????????????????????!??????????????????????

????????