?????????

2024?12???????????????????????????18???????????????????,??????????????????CNCERT?????????????????????????????????(

????????????

(???)?????

????Exchange??????????????????2?Exchange??????,?????????,??????????????????????,???

(???????)?

?,????2?,??????????????,??????????????????????????????????????????,????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????????????????????????????????????,??????,?????????

(?????????????????)??????????????30???????????????

??,?????????,???,??SSH?SMB?30????????????????????????????????????;?,??????????????????????????????????????????????????????????????????????,?????????????????websocket+SSH????????????????????????????,?????????????????????????????????,?WeChatxxxxxxxx.exe??????2????????????????????PIPE???????????,???????????????????????

????????????????????????

(???)??

??????????,?????????????????????????????,???????????????,??,??????????????????????????,????????????????????

(?)??????????????????????????????????

?????????????3????,????????????????????????????,2023??????5??????????2????,???????????????(95.179.XX.XX)??????????????,?,?????????????????????,?,??????????????????????????????“??”?“??????”?“????????????????????”?“?(?????????????????????+??????)”?“?????????????IP??????”?“???????????”??????

(????)?

??????????????????????????????,??????????????????????,2023?7?????26?,?????(65.21.XX.XX)??????????????,?,????????????,?,?1.03GB??????????,?“?”???“tip4XXXXXXXX.php”?

(???????)????

??????,??????????,?,????????????????????????????????????SSH?,??????????????,?????????????

???????

(??)??

??,?22????8???????????,?????????????10????20??????????????,?,??????

(??????)???????????????

2023?5???????2023????10???????????????????????,?30????,???IP???????????,???????????

(??)???????????????????????????

???????2????????PIPE????“c:\windows\system32\”?,?????????????????.net?,????????????,?KB,?TLS???????????????????,???????????????https??????,????websocket+SSH????,??

??????????????????????IP??????????

???????

2024?12??18?,?CNCERT?(

?????????????????????????????????????

(??????????????)?

2024?8???????????????19????????,???????????,????/??2024????8????????????21??????,???????????????????????????/????????????????

(???????????????????)??

2024????8???????????????????????21??12??????????,???????????,?,???????????????????????????,??????/xxx/xxxx?flag=syn_user_policy?????????,?/xxx/xxxStats?

(???)?????????????

2024?11??6?????????????????2024?????11??????????????8????????????????2024????????????11?????????????16????????????????????????,?????276???????????????????

???????

(???????????????)?????

?IP???????????,?????????,???,????????????,???????????????

(???????????)?

2024??11?6????????????????11?16???????????????????,?????3?IP????????,?,????????,?????????????,??????????????????????,??????????4.98GB?

????????????

(??)?

???????????,??22????8???????,?10????????????20???,?,??

(????????)?

?????????????5????????????????????????IP??????????????????????,??????????,??????????

(??????)?

????????????????????????????,????????????,???????????????

?????????????????,????????,??

(?????)???????????????

??????,?????,?,??????????276?,???????????,????

??????IP?

????????????????????:?????

??

??:???????????,??????????,??????????????