?????????:???????????????????????

????:?????????:????????

?????1??????????????????????17?????????????????????? ?????????????????????17?????,??

??????

2024????12???????????18?????????,??CNCERT??(

????????????????????????????

(??)?

2024????????????8?????????????19???????????????,??,??????????/???2024???8?????????????????21????,?/?????????????

(???????????????????)????

2024??????????8???????????????21?12?,???????????????????????????,???????????????????????????,???????????????????,?/xxx/xxxx?flag=syn_user_policy???,??/xxx/xxxStats?

(?????????)?????????

2024??????????11??6???????2024?????11??????????????8?????????2024????????11??16?????????,??????276??????????????????????????

?????????????????????????????

(?)????????????????????????

??????????????IP????????,??????,??????,?,??????????????

(?)??

2024??????????????11?6???????????????????11??????????????????????16????,?3?????IP????????,?,?,??????????????????????????,???,???????????????????????????????????????????????????????4.98GB?

??????????????

(?)?

????????????,?????????????????22????????????????????????8????????????????,????????10?20???????????,??????????,????????????????

(????????????)?

????5??????????IP??????,?,?????

(?)?

?,???????????,?????????????????

?,???,?????

(?????????)??????????????

????,???????????,?????????????,????276?,???????????????????,?????????????

???IP???????????

?

2024???????????????????12?????????18????,??????CNCERT??(

????????????????

(?)??????

?????Exchange???????????????????????2???????Exchange???????????????,?,????????,?????????????????????????????

(???????)???????????????

??????????????????????????????????,????2???????????????,????????????????,??????,??/owa/auth/xxx/xx.aspx???????????/owa/auth/xxx/yy.aspx,???????????????????????????????????????????,????,???????

(??????????????)?30?

????????????,?,?,??????????SSH?SMB?????30?????????;????,?????????????????????????????????????????????????????????????????????????????????,??????????????????????websocket+SSH???,?????????????????????????????????????,???????????????WeChatxxxxxxxx.exe??????????????2????????????????PIPE???????,??

???

(?????)?????????????

???????????,?????????????????,?????,???????????????????,???????????????????????,??

(??????????????)?

????????????????????????????3??????????????,?????????????????????????????,2023????5???????2????????,????????(95.179.XX.XX)??????????????????????????,???????????,?????????,??????????????????,?????“???????????????????????”?“???????????????????”?“?”?“?????????????(?+??)”?“?IP?”?“??”???????

(??????????????????)?

??????????????????????????,???????,2023???????????????????????????7?26?,???(65.21.XX.XX)??,???????????????????,??????,?????????????????,?????1.03GB??,?????“??????”????“tip4XXXXXXXX.php”?

(?????)??

???????,??,?,??????????????????????????????SSH????,???????????????????????,???

???????

(?)?????

???????????,??????????22?8?,?10??????????????20????,???,????

(?)?????????????????

2023?5????????????????????2023????????????????????????10?,?30???????,????IP?,??????

(???????)?????????????

????2????????????????PIPE??????????????????“c:\windows\system32\”??????,??????????????.net????,??????????,??KB,??????TLS???????????????????????????????????????????????????,??????https?,?websocket+SSH???????????,????????

???????????????????????????IP?

??:??