???????????????!?????????????????

?

2024???????12?18??????,???????????????????CNCERT??(

????????

(?????)???

???????????????????????????Exchange?????????2???????????????Exchange????,??????,??????????,???????????????

(?)??

?????,??????????????????2?????????????????,???????????????????????????,??????????????????,???????????????????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,??????????????????????????????,??????,?????????????????????????

(?)???30?

?,???????????,???????,???????????????SSH?SMB?30??????????????????????????????????;??,??????????????????????????????????????????????????????????,??????????????websocket+SSH???????????????????????,??????????????????????????????????????????,?WeChatxxxxxxxx.exe??2??????PIPE????,??????

??????????????

(?)?

?????????????,???????????????,???????????,?,?,???

(??????)??????????

????3??,??????????,2023????5?2??????????,?(95.179.XX.XX)?,?????????,???????????????????????,?????????????,?“???????????????”?“????”?“????”?“?(??????????????????????????+??????????????????????)”?“???????IP?”?“?”???????????????

(?????????????????????)?????????

????????????????????????,?????????????????????????,2023???????????????????????7???????????26????????,??????????(65.21.XX.XX)?,?????,????????????,???????????????????,????1.03GB??????,?????????????“??????????????????????”????“tip4XXXXXXXX.php”?

(????????)????

???????,???????????????????,?,???????????????????????????SSH????????,???,??

??????????????

(?)?

??????????,???22?8????,?10????20??,??????????????????????????,????????????????????

(?)??????????????

2023????????5??????????????2023?????10???????????,?30??????????????,????????IP???????????????????????????,?????????????????????????

(????)????????????

??????2?????PIPE???“c:\windows\system32\”?????????,???????????????.net?,?????,?KB,??????????TLS???????????????????????????????????????,????????????????https??????????????????,?????????????websocket+SSH??????????,??

????????????????????????????IP??

??????????????

2024?12????18?,?CNCERT??????????(

????

(?????????????????)???????????????

2024??8??????????????19??????,??????????,?/???????2024??????8??21????????????,?/???????

(????)?

2024?8?21?????????????????12??????????????,?????????????????????????,?????????????,????????????????,?????/xxx/xxxx?flag=syn_user_policy??,??????/xxx/xxxStats?

(?)?????????

2024?11?6???2024??11??????8????????????????2024?11????16?,??????????276??????????????????????????????????????

??????????????????????????

(???????????)??????????

???????????IP???????,?,???????????,???????,??????

(???????????????)??

2024?????11??????????6?11???????????????????????????16????????????,??????????3???????????????IP??????????????????????????????,???????,?,??????????????????????,??,??????????????????????????????4.98GB?

????????????????????????????????????????

(????????????????????????????)???

??????,????????????22??8????????,??????????????????10?20?,??????,??

(?)????

??????5????????????????????????????IP?,????,??

(???)?

?????????????,?????????????????????,?????

?,??????????,?????????????????

(??????????????????????)?????

????????????????,??,?,?????????????276?????????,???,??????????????????????

?????????IP?????????????????