�?????????�

????:????92?95?98?:?????????

???????????????

2024?12?18?????????????????,??????????????CNCERT???(

???????

(?)?

?Exchange??????????????????????2?Exchange?????,??????,???????????,??

(???????)??

????,???2????,????????????????????????????,???????????????????????????,?/owa/auth/xxx/xx.aspx????????????/owa/auth/xxx/yy.aspx,?????????????????????,?????????????,???????

(?????????)?30???????????????????

??????????,?????,?,??SSH?SMB?????????30??????????????;???????????,???????????????????????????????????????????????????,?websocket+SSH??????????????,??????????????????????????,???????????????????????WeChatxxxxxxxx.exe???????????????2??????????????????PIPE???????????,???????????????

??????

(??????????)??????????????

??????????,????????????????,?,?,?,???????????

(???????)?

?????????????????3???????????????,?????????????????????????,2023????????????????5????2????????,??(95.179.XX.XX)??????,???????????,?,???????,??????????????????????�?????????�?�??????�?�????????????????????????�?�?(??+????????)�?�??IP????????????�?�?????�??????????

(??????????)?

???????,??????????????,2023????????????7????????????????26????,?????????????(65.21.XX.XX)????,?,??????????????,???????????????????????,?1.03GB????,??????????�???????�???????????�tip4XXXXXXXX.php�?

(?????)?????????

????????????????????????,??,?????????????????,????????????????????????????????????????????????????????SSH?,?????,??

????

(????)?????

???,?22?8?????,??????????10???20????????,????????,??????

(??????????????)??????????????

2023??????5????????2023??10?,?????????????30???????????????????????????,??????????????IP?,??????????????

(?????)???

????2????????PIPE?�c:\windows\system32\�????????????????????????,?.net?????????????,??,???????????????????KB,????????????????TLS????????????????????????????????????????????,???????https?,?????????????????????websocket+SSH?,???????????

??????????????IP??????

????????

2024????12?18?????,???????????????????CNCERT?(

????????????????????????????????????????

(??????????????????????????)??????????????????????

2024?8?19??????????????????,????,??????/????????????????????2024?????????????????????????????????8?21??,??/???????

(??????????????????????????????????)??????

2024?8??????????????????????21??????12??????,??????????????????,?????????????????????,????????????????????????????????????,?/xxx/xxxx?flag=syn_user_policy????????????,?/xxx/xxxStats?

(????)?????????????????

2024?11?6???????????2024????11????????????8??????2024?11?16??,??276????????????????????????????????????????????????

??????????????

(???????????????)?????????

??IP????????????,?,????,??????????????,???????????????

(????)???????????????????????????

2024???????11?6???????????11????16????,??3?IP?????????????,??????????,??????,???????????????????,?,??????????????????????????4.98GB?

????????????????????????????

(???????????????)???

?,????22?8?,??????????????????10????????20??,???????????????????,?????

(?)??????

???????????????????????5?IP?????????,????????????????????????????,????????????????????