???????????????????????:?????????

??????????1????????????????????????17?????? ????17??????????????????????????,??

?

2024????????????12?????????????18???,??????????????CNCERT????(

???????????????????????????????

(??????)?

2024???????????????????8?19??????????????????????,?????,?????????/??2024????????????8???????????????21?,????/??????????

(?)???????????????????

2024?8?21?12?,???????????,?,???????????,???????????/xxx/xxxx?flag=syn_user_policy??,??????/xxx/xxxStats?

(????????????????)?????????????

2024?11???????????????6????2024?11?????????????????????????????????8???????2024?????????11??????????16?????,???276???????????????????????????????????????????

??????

(?)??

???????????????????????????IP?????????,?,????????,?,??????????????????

(???????????)?????????

2024?11?????????6??11?????16???????,?3???????????????????????IP???????????????????????????,??????????,????????,??????????????????????????????????????,??????,???????????????????????????????????????????4.98GB?

??????

(??????????)??

?????????????,?22??????????????????8??,??????10??????????????20????,?,???????????

(???????????????)???

?5?IP???????,???????????????,??????????

(??????????????)????

?,???????????????????????,????

??????,?,?????????????????

(?)?

???????,????????????????,?????,??????276??????????????,???????????????????????????,????

????????????IP????????????????

?

2024????12??18??????????????,??????CNCERT????????(

??????????????????????

(??????)??????????????

????Exchange???????2???????????Exchange???,?,?????????????,???????

(????)????

?,?2??????,??,??????????????,?/owa/auth/xxx/xx.aspx???????????/owa/auth/xxx/yy.aspx,??????????????,?,???

(???????????????????????)??????????????????????30??????????????????????????

???????????,????,???????????????,??SSH?SMB????30?????????????????????????????????;?,????????????????????????????????????????????????????????????????,?????????websocket+SSH?,????,??WeChatxxxxxxxx.exe????????????????2????????????????????????????PIPE????????,??

??????????

(?????????????????????)?????????????

?,??????,???????????????????????????,??????,?????,???

(?)?

?????????????????3??,???,2023????5????2??????,?????(95.179.XX.XX)????,???????????,????????,??,??????????????“?”?“???”?“?????”?“??????????????(????????????????????????+??????)”?“??????????????IP??????????”?“?”??

(???????????)?

?????????????????,?????????????,2023?????????????????????7??????????????????????26????????????????????????????,????????????(65.21.XX.XX)??,???????????????,?,????,????1.03GB????????????,?????“??”?“tip4XXXXXXXX.php”?

(?????????????)?

??????????????????,??????????????,???????????,?????????????????SSH??????????????????????????????,?????????,??????????????

?????????????????????

(??????????????????)????????????????????????

??,??????????????22?8??????????????????????,?????10???????????20????????????????????,????????,?????

(???????????)???????????????????

2023????????5????????????????2023?10???????,???????????????????30????????????????????,?IP???????,?????????????

(?)????

???????2?PIPE???????????“c:\windows\system32\”?,???.net?,????????????,???????????????????KB,?TLS??????????????????????????????,??????https?,???????????????????websocket+SSH??????,??????????????????

???????IP???????????????????????????