?1???????17??????????? ????????????????????17???,???????

??????????????????????

2024??????????12?????????????????18??,????CNCERT?(

????????????

(????)???

2024??????????????????????8??19?,??????????????????????,?/?????????????????????????2024?????????8?21?,???/??????????

(?)??????????????

2024???????8??????????????21??????????????????????12?,????????????,?????,???????????????????,???????????????/xxx/xxxx?flag=syn_user_policy???,??/xxx/xxxStats?

(????????????????)???????

2024?????11??????6???2024?????????11?8?????????????2024?11???????16?,??????????276????????????????????????????????????????????????????????

?????????

(????)?

???????????IP??????????????????????????,??????????,???????????????????????,?,???

(???????????????)???????????????

2024?11??6?11???????16???????????,?????????3????????????IP??????????,?,???,?????????????,?????,????????????????????????????????????????????????4.98GB?

??????

(?)?

????,??????22??8??????????????,???????????????????????????10????20??????????????,?,???????????

(?????????????????)?

??????5??????????IP??,?,?????

(???????????)??????

?,????????????????????????,??????

?,????????????,????????????

(???????????????????)??????????????????????????????????

?,????,?,???????????276??????,??????????????,??????????????????????????????????

???IP??????

?

2024????????????12???????????????18???????????????????????,???????????????????????CNCERT?(

??????????????

(???????????????????)???????

?????Exchange????????????????????????????????2???????????Exchange????????????,?,??????,?????????

(??????????????????)?

?????,??????????????2??????????????????,??????????????,???????????????????,???/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????????????????????????,????????,????????????????????

(?)?30???????????????????????????

?????????????,???????????????????,??????,?????SSH?SMB??????????????30??????????????????????????????????;?????,?????????????????????????????????????????????????????????????????????????????????????????????????????????????,????????????websocket+SSH??,??????????????,???WeChatxxxxxxxx.exe????????????????????????????2?PIPE??????,??

??????????????????????????????????????????????

(?)????????

?,??????????????????,?????,???????????,?,??????????????????

(????????????)????

?3?,????????????????????????????,2023?????5???????2????,????????????????(95.179.XX.XX)?????????????,????,??????????????????????????????,?,??????????“??????????????”?“????????”?“?????????”?“????(?????+?)”?“?IP???????????????????”?“?????????????”??

(??)?????

?????,?????????????????????????,2023?????7??????????????26??,??????(65.21.XX.XX)???????????????????????,??????????????,?,???????????,????1.03GB???,?????????????“?”???????????????????“tip4XXXXXXXX.php”?

(???????)?

???,?,??,???????????????????????SSH?????????????,????????????????????,?????????

???

(?)?????????????????????

?,??22????????8??????,????????????????????????10?20???,?,??

(?)??????

2023????5?2023?10????,?30?,??????????????IP??????,??????????

(????)???????????????

???????2????PIPE?????????“c:\windows\system32\”?????,?.net?,??,?KB,???????????TLS?????????????????????????????????????????,?https???????????????,????????????????websocket+SSH???????,???????????

??????????IP?????????

???????????????:???????????

??

??:???????????,??????????,??????????????