????:1?????????:???????

2???????

3???200????????

4????????

5??????????????

???

2024????12?18???????????????????????,??????????????????CNCERT?(

?????

(??????????????)??????????

?Exchange??????????????????????2????????????????Exchange???????????????????,?????????????????,??,??

(????????)??????????????????????

???????,?????????2??????,????????,????????,???????????????/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,?????????????????????,??????????,?????????

(?????????)??????????30?

?????,?,???,?SSH?SMB?30????????????????????????????????????????????;?????,??????????????????????????????????????????????????????????????????????????????????????????????????,???????????????websocket+SSH????????????????,????,??????WeChatxxxxxxxx.exe??2?PIPE????????????????????????????,?????

????????????

(??????????????????????????????)??

???,???????????????????,?,?,??,??

(??????????????????????????????????)????????????

?????3?????,????????,2023?5??????????2?,????(95.179.XX.XX)?????,???????????????????????????,??????????,?,?“????”?“????”?“?????????”?“?(??????+?????)”?“??IP????”?“????????”?????????????

(??)????????????????????????????

????,??????????????????,2023???????????????????7???26????????????????????????,???????????????(65.21.XX.XX)??,???????????,????????????,??????,???????????1.03GB??,?????“??”?“tip4XXXXXXXX.php”?

(?????????????????????)?????????????

??,????????,????,?????????????????SSH???????????????????,???????????????,?????????????????

????????????

(??????????????)?

??????????????????????,????????????22????8??????????????????????,????10?20?????????????????????????????????,?,??

(?)????

2023?5?????2023????????????????10??????????,???????????????30???????,?????????IP??????,??????????????

(??????)??????????????

????????????????????2?????????PIPE?“c:\windows\system32\”?,????.net???,?????????????,?????????KB,?TLS??????????????????????????,???????????????https?,??????websocket+SSH??,????????????????????????????

???????IP?

??

2024?12?????18?,?CNCERT?????(

??????????????????????

(??????)???

2024?8???????????????????19???????,?,???/???????2024???????????????????8????21?,???????/???

(???????????)?

2024?8???????????21?????????????????????12???????,??????????????????????,??????,?????????????,??????????????/xxx/xxxx?flag=syn_user_policy??????????????,??????????/xxx/xxxStats?

(?)????

2024?????11???????????6????????????????2024??11??????8???????????????2024??????11??????????????16????????????,?276??????????????????????????

???????????????????

(???????????????)????

???????????IP???????????????????????,???????????????????,??????????????????,??????????????????????????,??????????

(?????)????

2024?11?6?11??????????????16??????,??????????????3?????????????????IP?,?,?,???????????????????,???????????????????,??????????????????????????????4.98GB?

?????????????????????????????????

(?????????????)?

?,???????????????????????22??????8????????????????????????,???????????????????????????10?????????????20????????,?????????????????,??

(??????)???????

?5??IP????????,????????????????????????,????????????????????????

(?????)?

?,????????????,???

???????,??????????,???????????????

(??????????)????????????

????????????????,?,??????????????,???????????276?,????????????????,?????????????????

????IP?

??:?????????????