???????????????????????????1??17????????????? ?17??????????,??????

?????

2024????????????12????????????18????,???????????????????????????CNCERT?(

?????????????????????

(?????????????????)??????

2024???????8???????????????19????????,????????????,?/????????????2024???8??????????????21????????,?????????????/??

(??????)?

2024??????????8?21????12???,???,????,????????????????,???????????????????????????/xxx/xxxx?flag=syn_user_policy??????,??????/xxx/xxxStats?

(???)??????????????

2024????11???????????????6???????????2024??????????11????????????8??????????????2024?????????????????????11???????16??,?276????????????????????

????????????

(?)??????

??????????????IP??????????,????????,???????????????,???????????????,????????????????????

(??????????????????????????????????)?????????????????????????????????

2024?11?6????????????11?????????????16??????,??3?IP????????????????????????,????,?,???????????????,?,????????????????????????????????????????????4.98GB?

????????????????????

(???????????????)???????????????????????

???????????????,???22?????????8?????,?10?20?????????,?????,?????

(?????????)??

???????????????????????5????????????????????????IP???????????,?,????????????????

(??????????????)??????

????,????????????????????,??????????????

????,???,????????????

(???????????)?

?,??????????????????????,????,??????276????,????????????,????

????????????????IP???????????

???

2024??????12?18????????????????????????????,??????????????CNCERT?(

???????

(?)????????

??????Exchange?????????????????????2?????????????????Exchange????????,????????????,??????,????????

(??????????????)?

??,??????????????2????????????????,??????,???????????????????????????,?/owa/auth/xxx/xx.aspx????????????????/owa/auth/xxx/yy.aspx,??????????????????????????????,???????????,???

(?)????30?

???????????,??????????,????????,??SSH?SMB?????30??????????????????????????????????????????;????????,??????????????????????????????????????????????????????????????????????????,????websocket+SSH?,???????????????????,??????????????WeChatxxxxxxxx.exe????????2?PIPE??????,???

?????????????????????????????????

(???????????????)?

?,????????????,???????????????????,??,?????,?????

(?????)???

?3?,????????,2023????????5?2?,???????????(95.179.XX.XX)???????????????????,?,??,??????????????,?“?”?“???????????”?“?????”?“?(??????????????????+??)”?“???IP?”?“?”??????

(?)???????????????????????

?????,????????????????????????????????????????,2023?7?????????26??????,??(65.21.XX.XX)????,???????????????,???????????????????????,?,????????????????????1.03GB???????,??“?”?“tip4XXXXXXXX.php”?

(???????)???????

???????????????,?,???????,??????????????????????????????????SSH??????????????????????,????,??

???????????????????????

(??)?????

????,????22????????????????8??????????????????,?10?????????????????????20????????,?,????????????

(????)??????????????????????????

2023?????5?2023?10?????????????,?30????????????????,?IP?,??????

(?)????????????????

???????????????????2?????????????????PIPE?“c:\windows\system32\”???????,??.net???????????????????????,????,???????????KB,?TLS??????????????????????????????????????????,????????????????????https?????????,?websocket+SSH??????????,???????????

????????????IP??????????????????????????????

?????:??

??

??:???????????,??????????,??????????????