???????1???17? ??????????????????17?????,??????

???????????

2024?12???????????????????????18???????????,?CNCERT????????(

?????????????

(?)?

2024????????????????????????8?????????????19??,??????????????????,????????????????????????/?????????2024?8??21?????,?/????????????

(????????????????)????????????????????

2024????8??21??????????????12?,??????????????????,?,???????????????,??????????????/xxx/xxxx?flag=syn_user_policy??,???/xxx/xxxStats?

(??????)????

2024?11?6??????2024??????????????????????????????11??????????????????????8?????????2024??????11?16??????????,??????276????????????????????????????

??????

(???????)??????????????????????????

??????????IP?????????,??????????????,?,??,??????????????????

(???)??????

2024?11??????6???11?16??????????????,??????????????????????3?????IP??????????????,?,??????????????????????,??????????????????????????,?,?????????????????????4.98GB?

???????????

(??????????????????)????

??????????,????????????????22????????????8??????????????,??10?20????,???????????,???????????????????????????

(?)??????????

????????????5???????????????????????IP?,?,??

(??)??

????????????????,???????????????????,????????

????????,????,???

(???????????????)???????????????????????

??????????????,?,?,???276??????,??????????,????????

????????????????????IP????

???????????????

2024?????????????????????12?18?,???????????CNCERT?(

???

(???????????????????????????)?

?Exchange??????????????????????????2?Exchange?????????????,?,?????????,???????????

(??????????)????????????

???????????????,??2??,?????,?????????????,?????????????????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,?????????????????????,???????,?????

(??????????????)?????????????30???????

?,?,???????????????,??????????SSH?SMB??????????30??????????????;??,????????????????????????????????????,?????????????????????????????????websocket+SSH????????????????????,?????????,????????????WeChatxxxxxxxx.exe??????????2???PIPE???????,??????????

???

(????????????)??????????????

?????????,?????????????????????????,???????????????,???????????????,?????,????????????????

(?)????????????????????????

?3?????????????,???,2023??????????????5?????????????????2?????,??????????????(95.179.XX.XX)???????????????????????????,??????,?,?,???????????????????“???”?“??”?“????”?“????(?????????????+????????)”?“????IP?”?“?”???

(????????)???

?????????,???????????????,2023?7??????26???????,???????????????(65.21.XX.XX)???????????????????,??,??,??????????,?????1.03GB???????????,?“???????????????”????????????????????????????“tip4XXXXXXXX.php”?

(???)????????????????????????????

??????,????,?????,???????????SSH??????????????????????,???????????????????,????????????????????

???????????

(??)?????????????

????,???????????????????22??????????????8?,?????10????20????,??????,??????????????????

(????????????)????????????????

2023?????????????????5?????????????2023???????10???????????????,???????????30?,?IP????,???????????

(????)???????????????????????????

????2???????PIPE???????????????????????????“c:\windows\system32\”?,??????.net?,???????????,?KB,????????????TLS?????????????????????????????????????????????????????,?https??,?websocket+SSH????,?????

????????????????????????????????????IP??????????

???????:??????????

??

??:???????????,??????????,??????????????