???????????????????????:?????????

????:?????????????:???app

??????1???17?? ??17????????????????????????,??????????

???????????

2024???????????????????12??18??????????,???????????????CNCERT???????????????????????(

?????????????

(??)??????????????????

2024?8??????19????,??????????,?/?????????????????????2024?????????????????8?????21??????????,???????????????????/?????????????

(??????)?

2024???8?????????????21???????????????????12?,???????????????????,????????????????,????????????????????????????????????????,??????/xxx/xxxx?flag=syn_user_policy????????????????,?/xxx/xxxStats?

(?)?

2024?11?6????????????????2024???????????????????????11??????????????????????????????????8?2024?????????11???????16???????????????????????,????276????????????????????????????????????????????????????

???????????

(???)????

?????????IP?,???,?,????,?????

(?)??????

2024??11?6?????????11???????????????16??,?????????????3????????????????????????IP???????,?????,?,?????????????????,??????,?????????????????????????????????????????????4.98GB?

?????????

(??????????????)????

????????,???????????????22??????????????8??,?10???20??,????????,????????????????????????

(??)???????????

?5????????????????????????IP????,???????????????????????????,???????

(???)?

????????????????,???????????????????????,???????????

?,??????,?????

(???????)?

?,?????????????????????,???????????????????,???????????????276?,????????????,?????????????????????

??????IP??????????

??????

2024????????12??18?,??????CNCERT????????(

?????????????????

(??????)?

?Exchange????????????????????2????????????????Exchange??????,????????,?,?????

(???????????????????)????????????

???????????????,?2??????????????????????????,??????,??????,???????????/owa/auth/xxx/xx.aspx?????????????????/owa/auth/xxx/yy.aspx,???????????????,????,??

(????????)??30?

?????,???????????????????,?????????????????????,?SSH?SMB??????30?????????????????????;?,???????????????????????????????????????????????,??????????????websocket+SSH??,????????,???WeChatxxxxxxxx.exe??2?????????PIPE??????????????,?????????????

???

(?)???????????

??,???????????????????????????????????????????,???????,????,????????????????????,?????????????????

(???)????

??????????????????????3????????????,???,2023?????????5????2????,?(95.179.XX.XX)??,?,???????,?,??????????????“???????????????”?“?????????”?“????????????”?“????(????????????????+???????????)”?“?IP?????????????????????????????????”?“?”???????????????

(?)?????

??????????????????????????????????????????????,????????????,2023?????7?????26????????????,???????????????????????????(65.21.XX.XX)??????????,?,???????????????????,?????,?1.03GB??????????????????,??“?”????????“tip4XXXXXXXX.php”?

(?????)??????????????

??????,????,?,????????????????????????????SSH????????????,??????,???

???

(??)?????????

?????????,?22??????????????8????????,??????????10???????????20?????????????,?,???????????????????

(???????????????????????????)?????????????

2023??????????5?2023?????????????10?????,?30??????????????,??????????????????????IP????????,????????

(?????)????

????????????????????????????2???????PIPE?“c:\windows\system32\”?,?????.net?,????,???????????????????????????KB,?TLS????????????????????????????????,??????https??????????,??websocket+SSH?????,????????

???????????????IP???????????????????????

????:??