????:1?????:????????

2?????????????

3????????????

4??????????

5??????

??????????????1???????????????????????????17??????????????????? ??????????????????????????????????17??,??

?

2024??????12??????????????????18?,??????????CNCERT?(

??????

(?)??????????

2024????????????????????????????8?19?????????????????,?,?????????????????/???????????2024????????????????8???????????21??????,????/???????????????

(???)????

2024???????????????????8?????21????????????????12?,????????????????????????????,??????????????????????,???????????????????????????,???????????????????/xxx/xxxx?flag=syn_user_policy?????????????,???????????????????????/xxx/xxxStats?

(?????????????)???????????????

2024???????????????11?6???????????????????????????2024?????11??????8????????2024?11?16?,?????????????????276??????????????????????????????????????????????????

???

(?)?

???IP??????????,???????????????,?????,????,?????

(??????????????)????

2024?11?6???????11?????????????16??????,???????????????????????3???????????????????????????IP???????????,?????????,????????????,???????????????????????,?????,????????????????????????4.98GB?

??????????????????

(?)??????????

????????????????,?????????22????????8???,??????????????????????????????10?20????,????,????????????????????

(?)???

?5????????????????IP?????????,???????????????????????,????????????????

(?)???????????

?????????????,??????????????????????,??

???,?,??

(???)?????????????????????

??????????????,?,??????,??????????276?????????????,????????????????,??????????????????????????????????????

??????????????IP?

??

2024????????12????18??????,?????CNCERT???????(

???????????????????????????????

(???????)???????????????????

?Exchange???????????????????????????????????2??????????????????Exchange??????,??????????????,????,??????

(?)??????

?????????????,??????????????2?,????????,????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????????????????,?,??

(??)???????????????????????30?????

??,????????????,?????,??SSH?SMB?????????30??????????????????????;????????,??????????????????????????????????????,??????????websocket+SSH?,???????????,??????????????WeChatxxxxxxxx.exe???2???????????????????????PIPE???????????????????,??????

??????????????????????

(???????????)??????????

?????????????,???????,???????,????,???????????????,?????

(?????)?

?3?????????,????????,2023??5?????2?????,?(95.179.XX.XX)??????????,??????????????,?,??????????????????,?“????”?“?”?“?”?“???????(??????????????????????+???????????)”?“????????????????????IP??????????????????????????”?“????????”??????????

(?)??????????????????????

???????,?????,2023???????????7????????????26???????????,??????(65.21.XX.XX)????,?,???,??????????,?????????1.03GB??,????“????????????????????????”????????“tip4XXXXXXXX.php”?

(?)?

????????????????,???????????????,?,??????????????????????????????????SSH????????????,??,???

???????

(????)?????????????????

????????????????????????????,??????22????8??,????????10????????????20???????,???????????,???????????????

(?)????????????????????????

2023???5??2023?????????????10?,??30?,?IP??????????????????????,????????????????????

(??)??????????

??2??PIPE?“c:\windows\system32\”????????????,?.net???????,?,??????KB,??TLS???????????????????????????,????????????????????????https?????,??????????????websocket+SSH???????????????,??

????????IP?

??:??