?????????????????!???????????????

??

?

2024?????12?18????????,???????CNCERT????(

?????????

(????????????????????????)?

??????????????Exchange??????2?Exchange????,??????,??????????????????????,??????

(??????)???????????

?,?2?,?????????????,?????????????,?????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????????????,?????,??????????????

(?)?30??????????????????????

??????,??,??????????,????????????SSH?SMB??????????????????????30???????????????????;???????????????,??????????????????????????????????????????????,??websocket+SSH?????????????,??????,?????WeChatxxxxxxxx.exe???2????PIPE?,??

????????

(?)???????????????????

??????????????????????????,??????,???????????????,???????,????,?????????????????

(?)??

?????????3????,?????????????????????????,2023?????????????5???????????????????2?,??????????????(95.179.XX.XX)????,???????????,???,???????????,???????????????“??????????”?“????”?“???”?“?????????(????????????????+?)”?“???IP?”?“???????”???????

(??????????)?????????????

??????????????????????,???,2023???????????7???????26????????????,????????????(65.21.XX.XX)??????,??????,???,?????????????,????????????1.03GB???,???????“???????????”?“tip4XXXXXXXX.php”?

(??)?

??????,????????????????,?,???????????????????????????????SSH??????????,?,??

????????????

(?)?

??????,?22?8???????????????????,?????????????????10?20???,?????????????????????????????????,???????????????

(??????????????????)?????

2023???????????????????????5???????????????2023????10????,??????30????????,?IP??????????????,??????????????????

(???????????)???????????????

??????????2?PIPE????“c:\windows\system32\”??,????????.net?,???????????????????,????????????KB,??TLS?????????????????????????????????????,??????????https???,?????websocket+SSH????????????????,????

??????????????????????????IP??????????????

??????????????

2024?12??18?,????CNCERT????????????????????????????(

??????????

(????????????????????????)????????????????????

2024?8?????????19??,???,???????????/?????2024?????????????????8???????????????????????????21??,??????????????????/??

(?)??????

2024???????????8??????????????????21????12?,?????????????????,????????????????????????????,??????????????,????/xxx/xxxx?flag=syn_user_policy??,??????????????/xxx/xxxStats?

(????????)????????

2024?????11?6?????????2024??????????????11?8?2024???????????????????????????11??16????????,???????????????276?????????????????????????????????????????????????????????????

????????

(?????)?

?IP??????????????????????????????,????????,?,?,??

(??????)???????????????????????

2024?????????11????6????11????16?,??????????3?????????????IP?????,??????????,?????,????,?,???????????????????????????????????????????????????????4.98GB?

?????????????????????????????????????????

(???????????????)???????????

?,??????????22??????8??????????????????????????,????10?????????20???????????????????,????,??

(?????????)?

?????5?????????????????????IP????,???????????????????,?????????????

(???????????)??????

???????????????,????????????????????????????,???

?????????????,??????????????,???????????

(?????????)?????????????????

???????????????????????????,?,??,???????276??????????????,????????,??????????????????????????

??????????????IP?

????????????????????:???????????

?????????

??????????????????????!????????????????????

????????