?????????????????!???????????????

????????????????

2024????????????????????????12???????????????18?,?????????????????CNCERT?????????????(

???????

(?????)???????????????

????Exchange???????????????2?????Exchange????????????????,??,??????????????,??

(???????????)?

???????????,???????????????????????????2????????????,?,??????????????????????????,?????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????????????????????????,????????,??

(????)?30??????????

?,???????????,????????????,?SSH?SMB????????????????????????????30??????????????????????????;?,???????????????????????????????????????????????,???????????????websocket+SSH?????????,???????????????????????????,???????????WeChatxxxxxxxx.exe??????????2????????????????PIPE?,??

????????????????????????????????

(??????)?

?,????????,?????????????????????????????????,?????,???,????

(?)??????

????????????????3?,??????????????,2023?5?????????????2???,??????????????(95.179.XX.XX)????,??,??????????,???????,?“???????????”?“?”?“??”?“?(??+?)”?“??????IP?”?“???????????????”???????????????

(?)????????

??????????????????????????????,??????????????,2023?????????????7?26???????,??????????????(65.21.XX.XX)?,???????????,??????????????????????,????,???????????????????1.03GB??,??“??????????????”?“tip4XXXXXXXX.php”?

(???????????????????????)??????????????

??????,????,?????????????,????????????????????????????????????SSH???????????,???,???????????

??????????

(???????)??

????,????????????22??????8???????,????????????????????????????10???????????????20?????????????,?????,???????????????????

(??????????????)?????????????

2023???????5??????????2023?10???????,???????30??????????????????????,?IP???????????????????????,???????????

(??????????????)?????

?2?PIPE?“c:\windows\system32\”??????????,??????.net??,?,??????????????????????KB,????TLS???????????????????????????????,??????????https??,?websocket+SSH?,??????

???????????IP?????????????????

??????

2024????12???????18?,???CNCERT???????????????(

???

(????)?

2024????8????????????????????????19?,?????????????,?/????????2024????8?21??????,?????????????????/?????????

(??)????

2024??8????21???????????????????12??????????,?????????????????,??,??????????????????????,???????????/xxx/xxxx?flag=syn_user_policy??,????/xxx/xxxStats?

(??)??????????????

2024?11?????????????6??2024???????????????11???????????????????8????2024??????11???????????16????????????????????,????????????276??????????????????????????????

?????????????????

(??????????)????????????

?IP???,??,?????,??????????????,???????????????????????????

(??????????????)??????

2024???????????????????11?6??11??????16?,?????????3?IP???????,?,???????????,????????????????????????????????????,???????????,?????????????????????????????????4.98GB?

??????

(?????????)???????????????????????????

??????????????????????????????????,???????????????22?8???????????????,???????????????????10???????????????????????20??????????,????????????,????????????????????????????

(??)??????

?????????5??IP?????????,?????????????????????,?????

(?)??

?,?????????????????????????????,??

?,?,?????????

(??????????????????)?????

?????,????,???,??????276?,?????????????????,?????????????????

???IP??????????????????