?????????:???????????????????????

?1?????????17???????? ?17????????,???????????????????????

????

2024?12????18???????????????????????????,??????CNCERT????(

???????????

(????)????????????

2024?8?????????19????????????????????,????????,???/????????????2024????8??????????????21???????,???????????????/???????????

(??????)?

2024???????????8??????21??????12????,?????????????????????????,???,?????????????,?/xxx/xxxx?flag=syn_user_policy????????????????????????????,????/xxx/xxxStats?

(?????)?

2024????11??????????6??2024?????11??????8?2024??????????11???????????16?,??????????276?????????????????????????????????????????????????????

??????????

(?)????

?IP???????,?,??????,???????,???

(??)?

2024?11??6??????11?16?,????3???????????????IP????,????????,??,????????????????????????????????????????,???????????,?????????????????4.98GB?

?????????????

(?)??????????????

???,?22????8?,?????????????10??????????????20???????????,??????????,???

(???????)???????????????

??5?IP????????????????,?????,??

(?????????????????????????????????)?

?,???,??

??????????,????,??????

(??)????????????????

?,?,??????????,?????276??????,?????????,?????????????

????????????????IP?

???????????

2024?????????12?????????18?????????,???????CNCERT?(

??????????????????????????????

(?)?

????Exchange????????????????2??????????????????Exchange????????,???????????,?????????????????,???

(?)????????????

????????????,????2????????????????????????,???????????????,????????????????????,??/owa/auth/xxx/xx.aspx?????????????/owa/auth/xxx/yy.aspx,????????????????????????????????????????????????????????????,?,?????????????

(???????????)?30?

????,???????????????????,?????????????????,????????????????????????????SSH?SMB??30?????????????????????????????????????????????????????;?????????????,????????????????????????????????????????????????,?websocket+SSH?????????????,???????????????????????????????,????????????WeChatxxxxxxxx.exe?????2??PIPE??????????,??????????

??????????????????????????

(??????????????????????????)???

?,???????????????????????????????????????????????????,??,????,???????????????????,??????

(?????????)?

??????????3??????????????,????????????,2023???5???????????????????????2?,???(95.179.XX.XX)???,????????,??????,?,??????????????????????????????????“???????????????????”?“???????”?“?”?“?(??????????+?)”?“???????IP??????????????”?“??????”?????

(????????????????????)?????????????

???????????????????????????????????????????????,??????????????????????????????,2023?????7??????????????26??????,?(65.21.XX.XX)???????????????????????,?,?????????????,??????????????,???????????????1.03GB??,???????“????”??“tip4XXXXXXXX.php”?

(????)???????????????

????,??????????????,???????????,?????????????????????????????????SSH??,?,??

????????????

(??)?????

?????????????????,????22???????8???????????????????????,??????????????10????????????20??????????????????????,???????????,???????????????

(??????????????????????????)?

2023?????5?2023??10?,?30??????????????,?IP????????????,??????????????

(?????)??????

??????2?PIPE??????????“c:\windows\system32\”?????????,?????????????????.net?????,?,?????????????????KB,???????????????TLS??????????????????????????????????????????,?https???????????????????,????????websocket+SSH??????,??

???????????IP?