???????????????????????:?????????

?????????????1?????17? ?17????????,???????????

????????????????????

2024?12?????18?,????????CNCERT????????????????(

?????????????????????

(????????)????

2024???????8????19?????,?,?????/????????????????2024????????????????8???21?,?/????

(??)?

2024?8?21??????????12??????????,????,?????????????,??????,?/xxx/xxxx?flag=syn_user_policy??????,??????????????????????????/xxx/xxxStats?

(??????)??????????

2024????11????6???????????2024??????????????11?????????????????????8????????2024????????????11?????16?,????????????????????????276???????????????????

????????????????????????????????

(?)?

???????????????????????IP???????,?,?,????????????????????????,????

(????)?????????????

2024???????????????????????11?6?11???????????????????????????16?,????3?IP??????????,?????????,??????????????,?????????????????,????,?????????????????????4.98GB?

?????????????

(??????)???????????

??????????????????????,??????22????8???,???????????10???????20?????????????????,???????????????,??????????

(??????)?????

?????????????5??IP?,??,???????????????????????

(???????)?

?,????????????????????????????????,????????????

??????,??,??

(??????????)??

???,????,?????????,????276?,????????????????????,??????

???????????IP????????

???????

2024???????????12????????????????18?,???????????????CNCERT????????????????????(

????????????????????

(?)??????????

?Exchange??????2?Exchange???????????,?????????,???????????????????????????,???

(????????????)??

?????????,????2??,????,?????????????????????,?????????????/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,??????????????????,??????????,?????????????

(??)???????????????30??????????

?,?,?,?SSH?SMB?????????????????30????????????????????????????;??????????????,??????????????????????????????????????????????????????,?websocket+SSH??????????,????????????????,????WeChatxxxxxxxx.exe?????????????2????PIPE?????????????????????????????????,????????

????????????

(???)??????????????

???????????,????????????????????????,?,??????,???,??

(????????????????)???????

?3???????????????,?????????????,2023??5?2?,??????????????????????????(95.179.XX.XX)???????????????????,??????????????,?,??,????????“?????”?“???????????????????????????”?“?”?“??????????????????????(????+??????)”?“????IP?????”?“??????”??

(????????????)???????????????

?????????????,?????????????????????,2023?7??????????????????26??,???(65.21.XX.XX)????,?????,??????,???????????????,??????????????1.03GB?????,???????????????????“?”???????“tip4XXXXXXXX.php”?

(???????????????????)?

??????????????????,????????????,????????????????,????????????????????????????????????????????????????????????SSH?????????,??????,???????

????????

(?)?????????????????????

????,?????22????8?????,???10?20?????,?????,???????????????????????

(????????)?

2023???????????????????????????5?????????2023???????????10???????????,?30??,??????IP????????????????????????????,?????????????????????????

(?)?

????????????2???PIPE??????“c:\windows\system32\”??????????????????????????????????,???????????????.net?????????????????,???????????????????,??????????????KB,?????????????TLS????????????????????????????????,???????????????????????https?,????????????websocket+SSH??,????????????????????????

???IP??????????????