?????????????????!???????????????

??

?

2024????12????????????18?,?????????????????????????????????CNCERT??????????(

?????????????

(?)???????????????????

??Exchange?????????????????????????2?????????????Exchange????,?????????,??????,??

(?)????????

????,?????2?,???,????,?????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????????????,???????????,?????

(????)?30?????????????

?,?,???,??SSH?SMB?????????30??????????????????????????????????????????????????;??????????????,?????????????????????????????????????????????????????????????,?websocket+SSH????,??????,??????????????????????????WeChatxxxxxxxx.exe???????????????2?????????PIPE??,??

????????????

(??????)??

??????????,??????????????????????,?,?,?,????????????

(?)?????

?3???????????,????????????????,2023??5????????????????2???????????????,??????(95.179.XX.XX)?????????????,??,??????????,?,????????????????“?”?“????”?“??????????????”?“???????(????????+???????????????????)”?“??????IP????”?“?????”??

(?)?

?????????????????,????????????????????????????????????????,2023???????????????????7???????????????26????,????????(65.21.XX.XX)?????????????,?????????,??????,??????????????,???????????1.03GB????,??????????“??????????”?“tip4XXXXXXXX.php”?

(????????)???????????????????????

?????????????????,?????????,??,?????????SSH?,???,??????????????

????????????????

(????)?

????,??????????????22???????????8??????????,?10??20??????,?????,??

(?????)??????

2023?????5???????????????2023?10??????????????????????????????,??????????????30??????????,??????IP?,???????????????????

(????)?????

????????????????????2??????PIPE??“c:\windows\system32\”???????????,????????????????????????????.net??????,???????????????,??KB,?TLS??????????????????????????,???https??,???????????????websocket+SSH?,?????

??????????????????????IP????????

???????????????????

2024????12????18??????,????????????????????CNCERT?(

?????????????????????????????????????????

(?)??????????

2024???????????????8???????????????????19?,????????????????,?????????????????????/????2024?8??21?????,?????????????????/???????????????

(?)???????????????????

2024??????????????????????8?????21?12???,??????????????,???????????????????????,????????,???????????????/xxx/xxxx?flag=syn_user_policy???????????????,?/xxx/xxxStats?

(???????????)???????????????????????????

2024?11???????6??2024??????11?????????????8?2024?????????????11????????16???????????????,????????????????????????276????????????????????????????????????????

??????????????

(?????????)???????????

?????????IP???????????????????????????,???????????????????????????,??????,?,?????

(?????)????????????????????????????

2024??????????????11?6???????11??????????????16?????????????,????3????????????????IP????,?,??,????,?,????????????????????????????4.98GB?

????????

(?)???????????

????????????????????????,?????22??????????????8???????????,??????????????10?20????,???????????????????,??

(??????????)?

????5??IP?,??????????????????,?????????????

(????????????)?

?,?????,?????

??????????,??????,????????

(??????????????????????)??????

??????????????????????,????????????????????????,????????????,??????????276?,???????????????????????,???????????????

????IP???????????????????????????

?????????????????:?????????

?????????

??????????????????????!????????????????????

????????