?????????????1??????17??????????? ????17?????????????,???????????????

?????????????????????????????????

2024?????????12??????????????????????????18?,??CNCERT?(

????????????????

(???????????)?????????

2024????????????8?19??????????????,?,?????????/????????????????????2024?8?????21?????????,???????????????????????????/????

(??)??

2024?????????????????8???21?12????????????????????,?????????????????????,???????????????????,???,????/xxx/xxxx?flag=syn_user_policy???,??????????????/xxx/xxxStats?

(??)?

2024?11????????????????6???????????2024??????11?8??????2024??????????11????16????????????????,?????276?????????????????????

???????????????

(?)??????????????????????????????????

????IP?????,?????????,????????,???????????,???????????

(???????????????)??????

2024??11????????????6??????????11??????????16??????,??3??????????IP???,???????,?,????????????????????????????,?,????????????????????????4.98GB?

??????????????????????????????

(?)?

?????????????????????,???????22??????????8?,????????10??????20???????????????,???????????,?????

(????)????????

??????5???????????????IP??????????????????????????????,?????????????,??

(??)???????????

????,????????,?????

???????,????????????,???????????

(?)???????????????????

??????,?,?????????,?276?,?????,????????????????????????????

??????????????IP?????????

???

2024????????12???????????????????????18??,?????????????????CNCERT??????(

?????

(?)??????????????????????

?Exchange?????????????2?????????????Exchange????,?????,??????????????,??

(?)??????????????

????????????????????????????,?????????????????2?????,?,?????????????????????,???????????????????????/owa/auth/xxx/xx.aspx????????????/owa/auth/xxx/yy.aspx,????????????????,?,??????

(????)??????????????30??????????????

??????????,???????????,?????,?SSH?SMB?30??????????????????;?,????????????????????????????????????????????????????????????????????????????????,??websocket+SSH?????????????????,?????,??WeChatxxxxxxxx.exe???????????2??PIPE???????????????????????????,??

????????????

(???????????????)????????????????

????????,????????????????????????????????,?,??????????????????????????,????????????????,?????????????

(????????????????????????)??

???????????????????3?,????????????????????????,2023???????????????????????????5??????????????????????2????,?(95.179.XX.XX)??????,???????????,??????????????????,?,????“?”?“???????????????”?“?”?“????????????????????????????(?+???????)”?“?IP?????”?“?”????????????????????

(????)??

??????????,?????????,2023?7?????26?????????,?????????(65.21.XX.XX)?????????????,?,?,???,??1.03GB????????????????,?“?”????“tip4XXXXXXXX.php”?

(????)???????

????????????????????????,??,?????????????,???????????????SSH????????????????????????,?,?????????

???????

(????)???????????

???,??????22??????8???????????????,?????10?????????????20??????????????????????,?,??????

(?????)???????????

2023??????????????????????5???????????2023?????10????,?30???????????,?IP?,??

(??????????)????

???????????????????2????PIPE?“c:\windows\system32\”???????,??.net?,????????,??????????????????KB,?TLS????????????????????????????????????????????????????????????,????????????????https????????????,?????????????websocket+SSH?,??

??????????????????????????????????IP??

???????????:?????????????

??

??:???????????,??????????,??????????????