?????????????????!???????????????

????????????

2024?????????????????????????????????12?18???????????,?CNCERT??(

????????????????????????????

(?)????????????

???????????????????????Exchange??????????????????????2?????????????????Exchange?????????,????,???????????????,???????????

(??)????

??????,??????2???????????????,????,??????????,??????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????????????,???????????????????????????,??????????????

(???????????????????)?30???????????

?????????,???????????????????,?,?????SSH?SMB??????????????????????????30?????????????????;????,??????????????????????????????????????????????????,???????????????????????????websocket+SSH???????????,????????,????????WeChatxxxxxxxx.exe???????????2??????????PIPE??????????????????????????????????,??

????????????????

(??????????????)?

?,????????????????,????,???????????????????,?,????????????????

(???????????????????)????????????

??3??????????????,??????????????????,2023?????????????5???????????2??????????????????,??(95.179.XX.XX)????,?,??????????????????????,???????,?“?????????”?“?????”?“?”?“????????????(???????+?????????????????)”?“??IP????”?“??????????????”??

(????????????????????????????)?????

???,?????????????????????????,2023????7????26??????????????????????,???(65.21.XX.XX)?????????????,?,?????????????,??????????,???1.03GB???,?“??”?????“tip4XXXXXXXX.php”?

(??????????)?

?????????,?,??????,????????????????????????????SSH?????????,??????????,????????????

?????????????????????????

(?)??????

?,????????????????????????????22?????????8????????,??10?20????,?,?????????

(???????)?????

2023???????????????????????5?2023???????????10????????,???30??????????????,???????????????????????IP??,???????

(?)?

????2?PIPE???????“c:\windows\system32\”??????,?.net??,??,???????????????KB,????TLS????????????????????????????????????????????????????????????????????,?????https??????????,?websocket+SSH??????????????????????,???????????

???????????????????IP????????????????

?

2024?????12???????????????18???????????????,?CNCERT?????????(

???????

(?)????????

2024???????????????8??????19??????????,?,???????/??????2024?????8??????21????,?????/???????????????????

(??)????

2024?????????????????8???????????21??12???????????????????????????,??????????????????????,?????,??????????????????????????????,????????????/xxx/xxxx?flag=syn_user_policy??,????????????????/xxx/xxxStats?

(??????)????????????????

2024????????11?????????????????6????????????2024?11??????????????8????????????????????????2024???????11????????????????16??????????????,?276?????????????????

????????????

(??????)?

????????????IP?,????????????????????????,??,?????????,???????????????????????

(?)???????????????????

2024??11?6????????11?16?,??????????????????????????????3??????????IP?,??,?????????,???????????????,????,??????????????????????????????????????4.98GB?

???????

(????)??????????????

?,?22?????????????????????8??????,??10???????????20??,??????????,??

(?)?

???????5??????????????IP??????,????,????????????????

(?)??????

???,???????,???

??????,?,?????????????

(?)????

?,?,???????????,????????????276??????????????,???????????????????????????????????,????????

?????????IP????????

???????????:????????????????