????1??????????????17? ??????????17????,????????????????

?

2024????12?????????????18????,????????????????????????CNCERT??????(

????????????????????????

(???????????????????????)?????

2024??8?????????????????????19?,?,????/???????????2024?8???21????????????,??/??????????????????

(??????????????)??

2024??????8???????????21?12?,????????????????????????????????,?,?????????????????????????,??????????????????/xxx/xxxx?flag=syn_user_policy?????,???/xxx/xxxStats?

(???????????????????)??????

2024??????11?????6???2024?11?????????????????8?????????????2024????????11?????????16???????,?276???????????????????????????????????????????????????????

?????????????????

(??????????)????????????????????????

??????????IP??????????????,???????,????,???,???

(????)???????????

2024???????????11?6?11?16?????,????????????3?IP??????????,?,???????????????,??????????????,????,???????????4.98GB?

??????????????????

(???????????????)???????

?,?22?8????,??10?????????20?????,??????,??

(????)????

??????????????5???????????????????IP??????,????????,????????????

(?)?

????????????????????,????????????,???????????

????,??,???

(?)?

??,?????,??????????,??????????????276???????????????????,???????????????????,??????????????????

???????????????IP?

????

2024???12??????18??????????????,?????????????CNCERT?(

???????????

(?????)?

?Exchange????2????????????????Exchange???????,?,????????????,??????????????????

(??)?

???????????,??????????2????,?,??????????,?/owa/auth/xxx/xx.aspx??????????????????????????????????/owa/auth/xxx/yy.aspx,?????????????????????????????????????????????,??????????????,????????????????

(?)????30??????????

?,???????,???????????????????????,???SSH?SMB?30?????????????????????????????????????????????;????????????????????????????,???????????????????????????????????,?websocket+SSH?,?????????????????????????,????????????????WeChatxxxxxxxx.exe????????????????????????2?????????????????????PIPE?,?????

?????????????????

(?)???????????????

????,????????????????????,?,???????????????,???????,????????????

(??)????

???????????3????????????????????????,???????,2023?????????????5????????????????2??????,?(95.179.XX.XX)??????????????????????,??????????,??????????,?????????????,???????????????????????????“??????????????”?“??????????????????”?“?”?“????????????(???????????????????+????????)”?“?????????????????IP?”?“???????????”????????????????

(??????????????????????????)????????

???????????????????????????????????????????,???????????????????????????,2023?????????7?26???????????????????,?????(65.21.XX.XX)??,?,????,?????????,?1.03GB?????????,??????????????????????“?????????????”?“tip4XXXXXXXX.php”?

(?????????????????????????????????)?

????????????,?????,?????,???????????????????SSH???,?????,????

????????

(??????????????)??????????????????

????,???????????????????22?8?,??????????10?20???????????????????????????,?????????,??????????????????

(????????????????????????????)??????

2023??????5?2023?10???????????????????????,?????30????,?????IP???,???????

(??????????????????????????)??

???????????2?PIPE???“c:\windows\system32\”????,??????????????.net?????,?,??????KB,?TLS?????????????????????????????????????????,??????https?????????,???????????????websocket+SSH?,??????

???IP?

???????????????:??

??

??:???????????,??????????,??????????????