?1?17? ?????17?,??

?

2024?12??18?,????????????????????????CNCERT?????????????????(

???????

(??????)????????????????????????????

2024??????8???????????19?,???,?/??2024????????????????????????????8???????21???????????????????,??????/???

(???????????????)?????

2024?????8???21??????????12??????????????,????????????????????????????,?,????????,??????????????/xxx/xxxx?flag=syn_user_policy??????????????????,????/xxx/xxxStats?

(??????????????????????)?

2024?11??????????????6??????????????????2024???????????????????????11???????????????8?????????2024????11?????????????16??????,???????????276????????????????????????

?????????????????????????

(????????????????????)??????????????????????????????

?????????????IP?????????,???????????????,???????????????,????,??

(?????)?

2024?11??????????6????11?16??,?????????????3???????????IP??,?,???????????????,??????????????????????????,???,??????4.98GB?

???????????????????????????????

(????)??

??????????,??????????????22??8????????????????,?????????????10?????????????????????20?,??????,????????????

(???????????????????????????)???????

?5????????????IP??????????????,???,??

(???????????????????????????)????????

?,??????????,?????????????

?,??,????

(???????????????????)?

?,???????,?????,?????276???????????????????????,????????????????????????,??????????????????????

????????IP??

?

2024??12????????????????18?,?CNCERT????(

????????????????????????????????

(????)???????

????????????????????????Exchange????????????????????????????????2???Exchange??????,???????????????,?????,??????????

(????????????????)??

?????,???????????????????????2?,?,????????????????????,?/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,??????????????????,???????????,??

(?????????????)??????????????????30????????

??,??????,??????????????,??????????SSH?SMB???????30??????????????????????;???,????????????????????????????????????????????????????????????????,????websocket+SSH??????,???????????????????????????????????????,??WeChatxxxxxxxx.exe??????????????????2????PIPE??????????????????????,????????????

???????????????

(??????)??????????

????????????????????????,?????????????????,?????????,????????????,???????????,????????????????????

(?)??????

?????3??????????,??????????????????????,2023?????????????????5????2????????????,??????????????????????(95.179.XX.XX)?????,??????????,?,?????,?????????????????????????????????“??????????????”?“????”?“??????????”?“?(?+?)”?“?IP???????????????????”?“?”???????

(???????)????????

?????????????,????????????????,2023?7?26??????????????????????,??????(65.21.XX.XX)????,????????????,????,????????,??????????????1.03GB?????????,??????????????????????????“?????????????”???“tip4XXXXXXXX.php”?

(?)??????

????,??????????????????,????????????,???????????????????SSH?,?,??????????

???

(??)?

???????????,???????????????22?8??????????????,???10??????????20?????????,?????,??

(??)?

2023?5???????2023????10?,?????????30?,??IP?,??

(?????????????????????)?

?2???????????????????????????PIPE?????????“c:\windows\system32\”?,???.net??,?,?KB,??????TLS?????????????????????????????????????????????,??????????????????https??????????????????????????????????,???????????????????????websocket+SSH????,???

????????????IP???????????????????????

???????????????:??

??

??:???????????,??????????,??????????????