???????????????!?????????????????

?????

2024????12?18?,??????CNCERT?????????????(

?????????????????????

(????)???????????????

?Exchange????????2????Exchange?,????,?,??????????????????

(??????????????)????

???????????????????????,???????????????????2???????????????????????,???????????????????????????,????????????????????,??????????????????/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,????????????????????????????????????,??????????,??

(?)?30???????????????????????????

??????????????,?????????,???????????,?????????SSH?SMB????30????????????????????????????????????????????????????????;?,?????????????????????????????????????,????????????????websocket+SSH???????,????????????????????,????????????WeChatxxxxxxxx.exe????????2??????????????PIPE????????????,??????

???????????????????????????????????

(??????????????????????????)??????????????????????????????????

????,?????????,??????????,?????????????????,?,????

(????????????????????????)?

?3????????????,???????????????????????????,2023??????????5???????????2?,???????????????????????(95.179.XX.XX)??,??????????????,??????,????,????“??????????????”?“??????”?“???????????”?“?????????????????????(???????+???????????????????????)”?“?IP??????????????”?“????????????”?????????

(??????????)???????????????

???????????????????????????????????,???????????????????,2023?????????????7?????26??????????????????,??????????(65.21.XX.XX)?,?????,?,?,??1.03GB?????????????????????,??????????????“?”?????????????????????“tip4XXXXXXXX.php”?

(?????????????)?????????

?????????,?,???????????????????,???????????SSH?,??????????????,??

????????????????

(?)??????????????

?,???????22?????8??????,????????10??20?,??????????????????,??

(?????????????????)?????????????????

2023?5???????????2023???????????????????????????10????,????30??????????,??IP???????????????,?????????

(?)?????

?????????????2??PIPE?“c:\windows\system32\”???????????,?.net???,???,????????????KB,????TLS????????????????????????????????,??https????,???websocket+SSH?????,??????????

?????????????????????IP??????

??????

2024????????????????????12?????????????????18?,????CNCERT?????????(

????????????????????????

(??????)????

2024?8????19????????????,??,?????????/????????????2024???????????????????8?21??????????,?/????????

(??????????????????????)?

2024????????????????????????????8????21?12?????,???????????????????????????,??????????????????????????,???????????????????????????????????,?/xxx/xxxx?flag=syn_user_policy?????????????,???????????????????????????/xxx/xxxStats?

(??)?

2024?11????????6????2024??11?8?2024???????????????11???????????16?,????276???????????????????????????????????????????????

????????????????????????

(????????)??????????????

??????????????IP??,?,????????????????,??????????????????????,??

(???????)?

2024??????????11?6??11??16?,???????????????????3?IP?????,?,??,??????????,?,???????????????4.98GB?

????????????????

(??????????)???

??????,?????22?????8?,?10?20????????????????????????????,???,??

(?)??????

????5?????????????????????????????????IP????????,?,???

(?)?

??,??????,??

????????,??,??????????????

(?????)????????????????????????

???????????,????????,??????,???276????,?????????????????????????????,????????????

???????????????IP?

??????:???