?????????:???????????????????????

??1?????????????17? ????17????,??

??????????

2024?12??18????,??CNCERT???????????????(

?????????????????????????

(?????)?

2024???????????????????8?????????????????19???????????????????????????,????????,?/???????????2024???8???????????????????????????21????,????/??

(??)?

2024???????????8???????????????????21?????????12??????????????????????,???????????????,?,????????????????,???????/xxx/xxxx?flag=syn_user_policy?????,?/xxx/xxxStats?

(?????????????)?

2024????????????11?6??????2024??????????????????????????11??8????????2024?11????16???????,?276??????????????????????

??????????????????????

(?)??????????????

?IP????????????????,???????????????,????????,????,???

(?)?

2024???11?6????????11?16?,???3????IP???????????????????????,???????????????????????,?????,?????????????????????????????,?????????,????????????????????4.98GB?

????????????????????????

(????)?????????????????

??,?????????????????????????????????22?8??????????,???????????????10??????????20?,?,??????

(??)?

?????????????5???IP???????????????????,???????????,??

(?????????????????)?????????????

?????????????,??????,???????

?,??,?????

(???)??

?????????,???????,????????????????????????,????276?????????,??????,?????????

?????????????????IP????

?

2024????????????????????????12???????????????????????????18??????????????,?????CNCERT?(

?????????????????

(?????)??????????

????????????????Exchange??????2?????????Exchange??????,?,???????????,?????????????

(???????????????????????)???????????????

??????,??????????????2???????????????????,???????????????????,????????????,?/owa/auth/xxx/xx.aspx??????????????????????????/owa/auth/xxx/yy.aspx,?????????????????????,?,??

(???????????????????)??30?????????

?,??,?????,??????????????SSH?SMB??????30???????????????????????????;??????,??????????????????????????????????????????????????????????,????????????websocket+SSH??,????????????????????????????????,?WeChatxxxxxxxx.exe?????????????2??????PIPE???????,??????????

?????????????????????????

(??????????????????)????????

?????,?????????,???????????????????????,?,?,????????????

(???????????)??????

?3???????????,???,2023????????????5?2????,?(95.179.XX.XX)???????????????,?,?,????,??“?”?“???????”?“??????????????????”?“????????????????????(???+?)”?“??????????????IP?”?“?”???????????????????????

(????????????????????????????)?

????????,??????????????????????,2023??????????7??????26?????????????????,?(65.21.XX.XX)?,??????,???????,???????????????,??????????????1.03GB????????????????????????,????“??????????????????????”?“tip4XXXXXXXX.php”?

(????????????????)???????????????

??????????,??????????,???,?????????????????????????????????????????SSH??????????????,?????,????????

???????????????????????????

(??)?????

???????????,??22???????????8?,?10???20??????????????????????,??????????????,??

(????????????????)?

2023???????????5???????????????2023?????10??????????????????????????????????,??30???????????????????????????,?IP????????????,????????

(?)?

?????2??????????????????PIPE?????????“c:\windows\system32\”????????????????????,????????.net??????????,??????????,??????KB,???????????????TLS??????????????????????????????????,?????????????https?????????????????,?????websocket+SSH?,??

????????????????????????IP??????