???????????????????????:?????????

??

?1????????17? ??????????17?????????????,???????????????

??????

2024???????????12?18????,????????????????????????CNCERT??????(

???????????????

(???????????????)??

2024?8?19???????????????????,????????,?/??2024?????????????8???????????21?,???????????????/?????????????????

(??????????????)?

2024????????8??????????21?12????,?????????,???????,????????????????????????????,????????????/xxx/xxxx?flag=syn_user_policy??,???????????????????????????/xxx/xxxStats?

(??????)??????????

2024????????11?6??????????????2024???????????11??????8?2024???????????????????????11???????16??????????,???????????276????????????????????????????????????????

????

(?)????????????

?IP????????????,?????,????,????,???

(????)??????????

2024?11?????????6?????????????????11????????????16?????????????,????3??????????????IP?????,?????????,??????????????,??????????????,????????,???????????????????????????4.98GB?

????

(?)????????

??????,?22???????????????????????????8??,???????????????????10????????????20???????????????,???????????????????,??

(?????)???????????

?5????IP????,??????????,??

(????????????????????????????)???????

??????????,???????????????,??

??,?,?????????????????????

(????????????????)???????????????????????????

??????????????????????????????????,???????????????????,??,???????????????????????276?????????,???????????????????,?????????

???????????????????????????IP???????????????

??????????

2024????12?18???????????????????????,???????????CNCERT???(

?????????????????

(??????)?

???????Exchange???????????????????????2????????Exchange?,??????????????????????,??,??????

(?)????????????????

?????,?2?????????????,?,????????????????????????????????,???/owa/auth/xxx/xx.aspx?????/owa/auth/xxx/yy.aspx,???????????????????????,??,?????

(?????????)?30??????????????

??????,?,???????????????,???????????????SSH?SMB?????30????????????????;?,????????????????????????????????????????????,??????????????????websocket+SSH???,???????????????????,?????????????WeChatxxxxxxxx.exe???????????????????2???PIPE??,???????????????????

?????????????????????????????

(?)?

???,???,????????????????????????,????,????,??????

(???????????)???????????

?????????3??????????????????????,????????????????????,2023????5????2?,?????(95.179.XX.XX)??????????????,???????,??????????????,??????,??“???”?“??????????????”?“??????”?“?????????(??????+?)”?“??????IP????”?“????????????”???

(??????????????)????????????????????????

????????,???????????????????????????,2023??????7????????????26???????????????????,?(65.21.XX.XX)?,????,?????????,???????,??????????1.03GB??,??????????“????”?“tip4XXXXXXXX.php”?

(??????????????????????)?

?,?,??????????????,???????????????????????????????????????????SSH???????????,??,??

???????

(????????????????)???????

???,?22?????????????????8??????????????,?10??????????????20????,??,??????????????????????????????????

(?)??

2023????????????????????5????????????????2023????10???????????????????,??????????30?????????????????,?IP????,??

(?)?????????

???????????????2???????PIPE????????????????????????????“c:\windows\system32\”?????,??.net?????????,?,?????KB,?TLS???????????????????????????????????????,??????????????????????????https?????????????????????,?websocket+SSH???????????????,?????

??????????IP?

??:????

?????????

????????????????????????????:??????????????

????????