????????????????????????

2024???????????????12??????18????,????????????CNCERT???????(

?????????????????????????????

(??????????????????????)?

???????????Exchange????????????????2????????????????Exchange???????????????????????,??,??,????????

(?)??????????????

?,????????2?????????,??????????????,????????????????????????????,?????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????,?,????????????

(???????????)?30?

???,?,????????????????????????,?????SSH?SMB????30??????????????;????????????,????????????????????????????????????????????????????????,?????websocket+SSH??????????,????????????????,?????WeChatxxxxxxxx.exe?????????2????????????????PIPE???,??

?????????????????????

(??)?

?,?????????????????????,???,???????????????,??????????????????????????????????,???

(????????)??

???????????????????????????3?,?????????????,2023??5????????????????2?????,?????????????(95.179.XX.XX)?,??????,????????,??????????????,??????“????????”?“????????”?“??????????????”?“???????????????(??????+??????)”?“?????????IP?”?“???????”??????????????

(???????????????)???????????????????????

????????????????????,??????????????????????????????,2023?????????????????7?????????????????26??????????,?(65.21.XX.XX)??????,???????,?,?????????????????????,?1.03GB??,??“??????”?“tip4XXXXXXXX.php”?

(???????????????????????)???????????????

???????,????,??????????????,??????????????????????SSH?,????,?????

??????????

(?)??????????????????

?,????????????????????????????22??????8?????????????????,?10??????????????????????????20??????????????,?,????????????????????????????

(?????)??????????????????????????

2023?5???????????????????????????2023???10?,?????30???????????????,????IP?????????,????????????

(???????????)??

?2?PIPE??????“c:\windows\system32\”?????????,??????????????.net???????????,????????????,??????????????????KB,???????TLS??????????????????????????????????????????,??????https???????,?websocket+SSH?????,???????????

????IP?

????????????

2024?12???????????????????18?,?????????CNCERT????(

???????

(???????????)???

2024?8?19?,??????????,??/???????????2024????????????????????????????8?????????21?,?????????????/??

(?????????????)?????????????

2024???????????????8??21?12??,???????????,????,?????????????,????/xxx/xxxx?flag=syn_user_policy??,????????????????/xxx/xxxStats?

(??????????)????

2024?????????????????11?????6??2024?11????8????2024????11??????16??,??????????????????????????????276??????????????????????

??????????????????????????????????

(?????)?

?IP????????????????????,?,?,?,????????

(????)??

2024???????????????11???????????????????????????6????11????????????16?????????????????,????????????3?IP????????????????,??????,??????,????????????,?,??????????????4.98GB?

????????

(??????????????????????)????

???,??????????????22?8?,??10????????20????????????,????,??????????????

(?????????????)?

?????????????????????????????????5???????????IP???????,???,???????????

(???????????????????)??????????

??????????????,?????????????????????????????,??

????????,????,?????

(??????)?

?,?????????,???????????????????????,????276???????????????????,???????,???????????????????????????????????

??????????????????IP?

?????????????????????????:?????

??

??:???????????,??????????,??????????????