?????????:???????????????????????

?1??17????????????? ????????????17?????????????????????,???????????

????????????????????

2024?????????????12???????18??,?????????CNCERT????????????(

????????

(?????????)????????

2024???????????8???????????????????????????19???????????????????????????,?,??????????/????2024??????????????????????8??21?,???????/???????????????

(???????????????????????????)?????

2024?8?????21??????????????12?????????????????????????????????,??????????,???????????????????,????????????????????,??????/xxx/xxxx?flag=syn_user_policy???,????/xxx/xxxStats?

(?????????????????)????

2024??????11????????????6????????????????2024??11???????8??????????????2024?11????????????????16???,??????????276?????????????????????????????????????????????

???????????????????????????

(?)?????????????

?IP?,???????????????,????,??????????,????????????????????????

(?????????????)?

2024?????11??????????6?11??????????????16??????,?3????????IP???????????,????,??????????????????????????????????,????,?????,?????????4.98GB?

????????

(???????????????)?????????????

??,????????????22????8??,????????????????10???????????????????????20??,?????????????,????????????

(?)????

??????????????5???????????IP??,?,?????

(?)?????????

?????,???????????,?????

???????,???????????????,??

(????)?????????????

???????????,??????????????,??????????,?????????????????276????,???,?????????????????????????

?????IP?

?

2024??????????????????????????12??18?,????CNCERT??????????(

??????????????????

(?????)????

???????????Exchange????????????????????????????2??????????????Exchange?,?,?,?????????????????????????????

(?????)?????????????

?,?????????????????????2??????,???????????????,???,?????????/owa/auth/xxx/xx.aspx?????????????????/owa/auth/xxx/yy.aspx,???????????????????????????,???????????,???????????????

(?)????30?

????????,??,????????????,????????SSH?SMB????????????30??????????????????????????????;??????,??????????????????????????????????????????????????????????,?????websocket+SSH?????,??????????????????????????????,?WeChatxxxxxxxx.exe??2???????????PIPE?,???????????

???????????????????????????

(???????????????????????)??????

??,?????????,?????,????????????,??????,????????????

(????????????????????????)??????

?3????????????????????,?????????????????????????????,2023?????????5?2????,????(95.179.XX.XX)??????,?,???????,?,?????????“???????”?“???????????????????”?“????????”?“??(?+??????)”?“????????????????IP??????”?“???”????????????????????????

(??????????)???????????????

???,??????????????,2023???????????????????7??26????,??????????????(65.21.XX.XX)????????,?,?????????????????,?,?1.03GB??,?“???????????”???????“tip4XXXXXXXX.php”?

(???????????????????)???

??,?,?,????????SSH?,???,???????????????

??????????????????????

(??)??????????????

?,?????22?8????????????????????????,???????10?20?????????,????????????????,?????????????????

(?)?

2023?????????5?????2023??????????10?????????,????30?????,???IP??????????????,??

(???????????????????????????)?

?2?PIPE???????????“c:\windows\system32\”?,????.net?????,?,???????????????KB,????TLS?????????????????????????????????????????????,??????????????????????????https?,?websocket+SSH?????,???????????

?????????????????????????IP??????????????