???????????????!?????????????????

?

2024?12??????18??,???????????????????????????CNCERT????????????????????(

??????

(????)?

??????????Exchange????????????????????2??????Exchange??????????????????????,?,?,?????

(?)??????????????????????

?,??2?????????????,????????????,?????????,?/owa/auth/xxx/xx.aspx??????????????????????/owa/auth/xxx/yy.aspx,????????????????????????????????????????????,??????,???????????

(???)?????????30??????????????

????????,?????????,?,?SSH?SMB????????30??????;?,?????????????????????????????,???????????websocket+SSH?????????????,??????????????????????,???????????????WeChatxxxxxxxx.exe???????????2?????PIPE???,???

????????????????

(?)?

?????????????,?????????????????????????????,?,??????,??????????????,????????????

(????)???????????????

?3??????????????,?????????????????????????????,2023??????????????5????????????2???????????????????????,??(95.179.XX.XX)????????????????????????,????????,?????,?????,?“??????”?“???????????????????????”?“????????”?“?????????(????????????????+???????????????)”?“???????IP???????????????”?“?”???????

(?)??????

??????????????????????????,?????????????,2023?????????????????7??????26???????,?????(65.21.XX.XX)?,?,??????????,????????????????????????????,?1.03GB????????????????????????????,??????????????????????????????????“????????”???????????????????“tip4XXXXXXXX.php”?

(??????????)????????????????

?????????????????,?,???,?????????????????????????????????????????????????SSH?????????,?,??

??????????????????????????????

(?)??????

??????,????22???????????8??,?????????10??????????????20???????????,????????,??

(????)????

2023????????5????????????????2023?10?,??????????????30??,??IP?????????????,??

(??????????????)??????????????

?????????2???????????????????PIPE?“c:\windows\system32\”??????????,????.net?,?????????,?????????????KB,????????????TLS?????????????????????????????????????,???????????https??????????????????????????,?websocket+SSH???????????,???????????????

???IP????

???????

2024?????????????12????????18???????,?????CNCERT????(

????????????????????????????????

(????????????)??????

2024?????8??????????????19????,????,???????/???????????????????2024?8?21???????????????,???????????????/???

(?)???

2024???????????8??????????21????????????12???????????????????,???????,?,?????????,???????????????????????/xxx/xxxx?flag=syn_user_policy??????????,????/xxx/xxxStats?

(??)????

2024??11?????????????????????????????????6???????????2024??????????????11???8??????2024?11????16???????????????,??????????????276??????????????????????????????????????????????

??????????????????????

(??????????????????????????????)?????????????????????

?IP???????????,????,?,?,??

(????????????????)??

2024??11?????6???????????????????11???????????????16?,?????????????????????3???IP????,????????????????,?,??????????????,?,????????????????????????????????????4.98GB?

???????????????????????

(???????)??

??,?22??????8?????????????????,?????????10?20?????????????,???,???????????

(?)?????

?????5?????IP??,??????????,???

(?????)?????

??????,????,????????

???,??????????,????????????????

(???????????)?????

????????????,??????????,??,????276?,???,?????????????????????????

???????????????????????????????IP??????????

?????:???????