???????????????????????:?????????

??

???????????1?????????17??????????? ????????????????17?,?????

????????????

2024??????12?18????????,????????CNCERT???????????(

?????????????

(??????)??????????

2024???????????????????????????8?19??????????????????????????????,?,?/?????2024??????8?21????????,???/????????????????????

(?)????

2024??????????????8??21??????????????12?,????????????????,??????????,????????????,??????/xxx/xxxx?flag=syn_user_policy???????????????????????,??/xxx/xxxStats?

(????????????)??

2024???????11??????????6??2024??????????????????????11????????????????????????8?????????????2024???????11????16????,??????????????????????????276??????????????????????????

?????????????????????

(??????)?

????????IP?????????????????????????????????,??????,?,?,?????

(???????????????????????)??

2024??????11?6?????11??????????16???,?3?????????IP???????????,?????????????????,?????????????,???????????????????????????,???,???????4.98GB?

??????????????????????

(???)??

????,?22?????8?,?????????????10????20???,???????????????,??

(??????????????)?????

?????????????????????5????IP??,?,??????????????????

(?)????????

?,???????????????????????????,????????????????

????????????????,?,??????????????

(??????????????????????????????????)??????????

????,??????????????????,?,????????????276????,???????????????????????????????,???????????????????????

???????????????????????????????????????IP?

??????????

2024?12????????18?,????????????????CNCERT???????????????(

?????????????????????????

(??????????????????????)?

?Exchange?????????????????2???Exchange?,????,??????,??

(??????????????)????????????????

??????????????,?2???????????????,?,?????????????????,??????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????????????????????????????,?,?????

(???????????????????????)???????????30???????????????????

?,?,?????,??????????????????????SSH?SMB?????????????30??????????????????????????????;?????????,????????????????????????????????????????????,?????websocket+SSH???????????????????,?????????????????????,?????????WeChatxxxxxxxx.exe??????????????2??????????????????????????PIPE????????????????,????????

??????????

(????????????????????)?

?????????????????,????????????????,?????????,??????????,?,????

(????????)???????

?????????3????,????????????????????,2023?5???????????2???????????????,???????(95.179.XX.XX)??????,???????????,???????????????,??????,?“?”?“?????”?“?????????????”?“??(???????????????????+????????????)”?“?IP?”?“???????”??????

(???????????)?

????????,??????????????????????,2023?????????7??????26??,????????????????????????????(65.21.XX.XX)?,???????????????,??????????????,???????????????,????1.03GB??,?????“????”?????“tip4XXXXXXXX.php”?

(?)??

?????,???????????????????????????,??,?????????????????????????SSH????????????????????????,?????,????

???

(????)?

??????,???????????22????????????8???????,???????????????10?20???????????????????????,????????,??

(???????????????????????????)?

2023??????????????5???????2023??????10?,??????????????30?,??????????IP?,???

(?)??????????????

?2?????????????????????PIPE??????????“c:\windows\system32\”????,?.net??,??????????,????????????KB,?TLS????????????????????????????,?????https??,????websocket+SSH???????????????????????,??????????

???????????????????????IP??????????

???????????:??

?????????

????????????????????????????:??????????????

????????