?????????????????!???????????????

??

?

2024???12???????????????18???????,????CNCERT?(

????????????????

(???)?

????????Exchange???2??Exchange?????,??????,??,?????????????????

(??????)?

????,???2???????,?????,???,???????????????????/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,?????,??????????????,???

(??????????????)????30?

???????????????,????????????,??????,????????????SSH?SMB???????????????????????????30?????????????;?,?????????????????????????????????????????????????????????,????websocket+SSH??????,????????????????,?????WeChatxxxxxxxx.exe?????2?????????PIPE??????????,??

??????

(??????????)????

???????????,????,????,?,?,??

(?????????????????)????

???????????????????????3?,?????????????????????????,2023??????????5???????2????,??(95.179.XX.XX)?????,???????,??,?,???????????????????????????“??”?“???”?“??????????????”?“?????????????????????(?+?)”?“??????????????????IP???????????”?“???????????????????????”??

(????????????????????????????)??????????????

??????????????????,??????,2023?7?????????????????26?,??(65.21.XX.XX)?,???????????????,????????????????????,??????????????????????,????????1.03GB?????????,???????????????????????“?????????????”????????“tip4XXXXXXXX.php”?

(?)?

?????????????,???,????????????????,???????????????????????????????????????SSH??????????,??????????????????????????,???????????

???????????????????????

(?)?

???,?22??????????8?????????,?????????????10????20????????????????????????????,????????????,??

(??)?

2023?????5??2023??10????????????,????30?,????IP?,?????????????????

(??????????)??????????????????????

?2???????????PIPE??????“c:\windows\system32\”??????,??????.net??????????,?,??????????????KB,?TLS???????????????????????????????????????,???????????????https??????????,??????????????????websocket+SSH?????????,????????????

???????IP????????

??????????

2024???????12?18????????,???????????????????CNCERT?????(

???

(???????????????)??????????????????????????????

2024???????????????8???????????????19?,???,??????????????/???????????????2024????????8??????????????????????????????????21?????????,????/??????????????

(??????????????????????????)?

2024???????????8?????21?????12?,????????????????????????????????????,????????????????????????,???,????/xxx/xxxx?flag=syn_user_policy??????,??????/xxx/xxxStats?

(???????????????????)????

2024????11?????????????????6????????????????2024???????????????11?????????8????2024?????11?16?????????,????????????276?????????????????????????????????????????????????????

????

(?)??

??????????IP??????????????,???????????,??????????,?????,??

(?)?

2024??????????????11????????????????????????6?11???????????????????16?,???3??IP???,?,???????,??????????????????????????????????????????????????,???????????,??????????????????????????????????????????????4.98GB?

????

(?)?

??????,?22????????????????8??????,?10??20????????????????,???????????????????????????,???????????

(???????)?????

????????????5?IP???????,????????????,????????????????

(??)??

??????,????????????????????,????????????????????

?????????,????????,??????????

(?????)?

??????,?,??????,?????????????????????276????,???????????,???????????????????????????????

?????????????????????IP??????????????

????????????????????:?????????????????????

?????????

??????????????????????!????????????????????

????????