???????????????!?????????????????

???

2024??????12????????????18???,??CNCERT?(

??????

(???????????????)?????????

????Exchange???2??????Exchange?,???????,??,???????????????????????????????????

(???????????????)???????????????????

??????,????2?????????????,??,????????????,??????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????????????,?????????,???????

(????????????????????????????)????30???????????

????,?????,??????????????,??SSH?SMB??????30??????????????????????????????????;????,?????????????????????????????????????????????????????,???????????????websocket+SSH????????,??????,??????WeChatxxxxxxxx.exe??????????2?PIPE????????????????????????????,??

????????????????????????????????????????

(??)??????????????????????

???,???,?,???????,???,??

(??????????????)?

????????????????????????3??????????,?????????????????,2023?????????????5?2?,???????(95.179.XX.XX)?????????,????,?????????,?,?“??”?“????”?“???????”?“?????????????????(??????????+???)”?“?????????????IP????”?“?”??

(????)?

?????????????????????,?????????,2023???????????7?26?????????????,?(65.21.XX.XX)?,??????????,????????????????,?????,??1.03GB??,??????????????????????????“????????????”???????????????????“tip4XXXXXXXX.php”?

(?)????????

??????????,??,???????,???????????????????????????????????????SSH?,?,??

????????????????????????

(????)????????????????????????

???,???????????????22?8?????????????????,???????????????10?20?,????????,?????

(????????)?

2023??????????????????????5?2023??????????????10??????????????,?30?????,?IP???????????????????,???????????????

(???????)??????????????

??2????????????????????????PIPE???????????????????????????“c:\windows\system32\”??,???????????.net??,?,????KB,????????TLS?????????????????????????????,?????????https????,??????????????????websocket+SSH??????????,??????

?????????????????????IP??????????????

????????????

2024??????12????18?????????,????????CNCERT??????????????(

??????????????????????????

(????????????)?

2024????8??19??????,????,???????????/??????????????????2024??????8?21?????,???????????????/???????????????????

(?)?????

2024?????8?21??????????12???????????????????????????,????????????????????????????????????????????????????????,?????,?????????????,?/xxx/xxxx?flag=syn_user_policy??????????????,???????/xxx/xxxStats?

(?????)??????????????

2024????11?????????????????6???2024???????????????????????11?8??????????2024?11??????????16???????????????,???????????????????????276?????????????????????????????????????????????????????

????????

(????????????)?

?IP??,???,???????????????????????,??????,??

(?)?

2024??????11??????????6????????????????11?16??????????,????3???????????????IP??????????????????????????????,???????????,?,????????????????,??,?????????????????????????????4.98GB?

??????????????

(?????????????)???????????

????????,???????????????????22???????????8???????????????????????,?10?20????,?,??????

(?)???????????

??????????????5?????????IP?????,?,?????

(????????)?

?,????????????????????????????????????????????????,????????

??????????????????,?????????????????????,????????????

(?????????????????)??????????

???????????????????,???,????,?276?,????????????????,???????????

?????????????????????????IP???

???:????????????????