???????????????????????:?????????

????:?????????:???????????

????????????????????????1?17??????? ??????17???????????,????

?

2024??????????12??????????18?????,?CNCERT????????????(

?????????????????????

(?)?????????????

2024?8???????????????????????????19???????????,?,?/??????2024?8?21?????????????????,?/?????????????????

(?????????)????????????????

2024??????????????????8?21??????????12???????????????,???????,??????????,?????????????????????,??????????????/xxx/xxxx?flag=syn_user_policy??,???????/xxx/xxxStats?

(????????)????????????????????????????

2024??????????????11???6??????2024????????11?????????????????8????2024???11?????????????16?,?276????????????????????????????????

????????????????

(??????????????)?????????

?????????????IP???????????????????????,?????????,???????????,??????????,????????????????????????

(???????????????)????

2024???????????11????????????6??????????11???????16???????????????,???????????3?IP?,??,?,???????????????????????,??????,???????????????????????????????4.98GB?

??????????

(?????????????)???????????

?,??22?8????,???????????10??????????????20?,?,???

(??????????????????????)????????????????

?5???IP??????????,???,???????

(???????????????)???????????????????????

????????,???????????????????????????????,?????

??????,??????????????????????,??

(???????????????????????????)?????????????????????????????????

???????,?,????????,?????276????????????,???????????,???????

?????????????????????????????IP????????????????

??????

2024??12???????????????18????,??????????????CNCERT????????????????????????(

??????

(?)??????????????

????????????Exchange??????????????????????????????2???Exchange?,???????????????,???????????????,??

(?)???

????,??????????????2?????????????,?,????????????????????????????,??????????????????????????????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,??????????????????,??????????,?????

(?????)?30?

??????????,?,???????,???????????????????SSH?SMB????30?????;??????????????,??????????????????????????????????,?websocket+SSH?????,????????????,????????????????????????????WeChatxxxxxxxx.exe?????2?PIPE?????????,????????

?????????????

(???????????????)???????????????

??????????????????????????,????????????,?????????????????,????????,??,??

(??????????)??

?3???????????????????,????????????????,2023????5?2?,?(95.179.XX.XX)??????????????????????,?,??,??????,???“??????????????????”?“??”?“????”?“???????????????????????(?+??????)”?“?IP???????????”?“???????”?????????????????????????

(?)?

????????,????,2023??7??26?,?????????(65.21.XX.XX)?????????,?????????????????,????????,?????,???????????????????1.03GB??,????“?”????“tip4XXXXXXXX.php”?

(????)???????????????????????????

??????,??????????????,?,???????????????????????????????SSH??????????????????????????,????,??

????????

(???????????)???????

?????????????????????,??22??????8??????,???10???????????20??,?,???

(?)???????????

2023?5?????????????????????2023??????????????10???,?30????????,????IP????????????????,???????????????

(??????????????????????????????)????

?????????2????????????PIPE??“c:\windows\system32\”???????????????????????,?.net?????,?,??KB,?????????TLS?????????????????????????????,??https??????,????websocket+SSH????????????????????,???????????????????????

??????????????????IP????????????????????

???:??????????????