????:1??????????:??????????

2??????

3?????????????

4???????????

5????????????????

?????

2024????12?18????????,????????CNCERT???????????????????????(

???????????????????????

(?????????????)?

????????????????????????Exchange???????????2????????Exchange????????????????????????,?,?,???????????????

(????)?????

??????,??2???????????????????????????,???,?????????????,???????????????????????/owa/auth/xxx/xx.aspx???/owa/auth/xxx/yy.aspx,???????????????????????,????????,??

(?)?30?

??????????????,??????????,???????????????,?????????SSH?SMB????????????????????????30???????????????????;?,??????????????????????????????????????????????,?????websocket+SSH??????,???????????????????????????,?????????????????????WeChatxxxxxxxx.exe??2????????PIPE??????????????????????????????,???

??????????????????????????????

(????)???????????

?????????????,??????????????????????????????,?,?,?????????,????????

(?)??????????

?????3?????????????,??????????????????????????????????????????,2023???????????5??2??????????,????????(95.179.XX.XX)????,?,???????????????,?,??????????“?”?“????”?“????????????????”?“???(???????+?)”?“????????????????????IP??????????????”?“?”??

(?)???????????????

??????????????????????????????????,???????????????,2023?????????????????7??26?????????????????????,????(65.21.XX.XX)?,?,??????????,????????????,???????1.03GB??????????,??????????????????“?????????????”??????????“tip4XXXXXXXX.php”?

(???????)???????

?,??????,?????,?????????SSH???????????,??,????????????????

???????

(?)???????????????????????

?????????????????,????22?8????????????????,????????????10??????????????20???????????,???????????????,????????????

(?)?

2023??????5???????2023??????10??,?30????????,?IP???,???????????

(??????????????????????????????????)?

?????????????2?PIPE??????????????“c:\windows\system32\”???????????????????,???????????????????.net??????????????????,????,?KB,??????????TLS????????????????????????,????https??????????????,????????????????????????????websocket+SSH????,?????????????????

????????????????????????IP?

?

2024???????????12???????????????????????????18????,???????????????CNCERT?(

?????????????????????????????????????????????????????

(?)????????????????????

2024?????????8????19?,????,?????/??????????2024????8????21?,??????????????????????/??????????

(?????????)?

2024??????8?????????????21???????????????12??????????????,??????????????????????,?,??????,??????????????????/xxx/xxxx?flag=syn_user_policy????,????????????/xxx/xxxStats?

(???????????????)??

2024????11??????6??????2024?11?????8?2024??????????????11?????16???????,?276????????????????????????????

???

(?)???????????????

??IP?,?,?????,???,??

(??????????????)??????????????

2024??11?????????????6???????????????????????????11??16?????,?3??IP??????????,???,?,?????????,??????????????,?????????????????????????????4.98GB?

?????????????????????????????

(??????)?

??????,?????????????????????????????????22???????????????????8???????????????????????????,??10????????????20????????,?,?????????????????

(?)?????

?5??IP???,???????????????????,????????????????

(?)????????????

?????????????,??????????????,??????????

?,??????????,?????

(??)????

???,????????????,?,?276?????????????????,??????????????????????????,?????????

?????????????IP???????????

????????????:??