???????????????????????:?????????

????:???????:?????????

??????1????????????????????????????17??? ??????????????17????????????,?????????????????????

???????????????????????????

2024?12??????????????18????,???????????????????????????CNCERT?????????????????(

??????

(????????)??????

2024?8?19????????????,?,???????????/??????????????????2024????????????????????????8?21???????,?/????????????????????

(?)???????

2024??8?21????????????????????????12?????,???????????????????,??????????,???????????????????????????????????,??????/xxx/xxxx?flag=syn_user_policy??????????,??????/xxx/xxxStats?

(?)???????????????????

2024??????????????????????11?6??2024?????11????8?2024????????????????11??????????????????????????16??,???????????????276???????????????????????????????????????????????????????????????????

????????????????

(??)????

?????IP??????????,????,????????????,??????????????,???????????

(???????????)????????????????????

2024???????????????????11????6?11???????16?,?3??????????IP?????,????????????,?,????????????????,?????????????,??????????????????????????????4.98GB?

?????

(???)????????????

?,??????????22???8?,?????10??20?,?,??????????????????????

(????????)?

???????????????5??????????????????IP???????????????,???????,???????????

(??)??????????????

????????,?????,??

????????????????,?,???????

(??????????)??

??????????????????????,?????,?,????????276???,??????????,????????????????????

?????????????????IP?????????????????

???

2024????????????????????????????12??????18?,??????????????CNCERT??(

?????????????????

(?)??????????

???????Exchange??????????2??????????????????????????????Exchange?,?????,???????????????????????????,?????

(????????????)?????????

???????????????,????2?,???,???????,??????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????,?,??

(?)????30?????

????,?????????????????????,?????????????,?????????SSH?SMB?30??????????????????;?????,????????????????????????????????????????????????????????,???????????????????????websocket+SSH?????????,?????,?WeChatxxxxxxxx.exe???????????????2??PIPE?,?????????????????????????

???

(????)???????????????????

?????????????,??????????????,???????,??,??????????????,????????????

(?????????)????????????

??3??????????????,???????????????????????????????,2023???????5?????2?,???????(95.179.XX.XX)???????????,????????????????,????,??,???????????????“????”?“?”?“????”?“?(????+????)”?“?IP??????????????????????”?“??????”??????

(???????????????)?

??????????????????,???????????????????????????????,2023??????????????????????????????????7??????????26??,??????????????????(65.21.XX.XX)?,?????????????,????????,?????????????,??????1.03GB??,??“????”???????????“tip4XXXXXXXX.php”?

(?)?

???????????,????????,???????????????????????,?????????????????????SSH??????????,?,??

????????????????

(???????????????????????????)???????????????????

????????,??????????????22???????????????????????8???????????,???????????10?????20?,????????,??????

(?)??????

2023???????????????????5?2023?10?,??30?,?IP??????,????????????

(???????)?????????????

???????????2???????????????????PIPE?????????“c:\windows\system32\”???????????????,??????.net?????????,?,?KB,??????????????TLS????????????????????????????????????????????,????https?????????,?websocket+SSH????,???????

??????????????IP????????????????

?????:?????