????:1????????:????

2?????

3???????

4??????

5?????????????

??1?17? ?17?????????,???

?

2024????12??????18???????????,?????????CNCERT??????(

?????????????????

(??????????????????)?

2024?8?????19?,?,???/??2024?8????21?????,?/??????????

(???????????????????)???????????????????

2024?????8????????????????21??????????12??????????????,??????????????????????????????????????????,????,????????????????????????,????/xxx/xxxx?flag=syn_user_policy???,?/xxx/xxxStats?

(?)?????????????

2024???????????11???????????????6??2024??????11?????8???????????????2024????????11??16?,??????????????????????276?????????????????????????????????????????

???????

(????????)??????????

?IP??,?,?????,?,??????????????????

(?)??????????????

2024?11????????????????????????6?11?16?,???????????????3???????IP?,????,??????????,????????????????????????,???????????????,???????????????????????4.98GB?

????????????

(?????)?

???????,?????22???????????????????????8??????,???????10?20?,????????,??

(?)????????????

??????????????5??????????????????IP???,?,?????

(?)???????????

????????????????,??????????????????????????,?????????????????????????

??????????,?????,????????????????

(?)?

??,??????????,?,?????????276????????????????????,??????,??????

??????????????????????????????????????????IP?????

??????????????

2024???12?18?????????????????,??????CNCERT??????(

?????????

(?)?

????????????????Exchange????????????????????????2????????Exchange????????????????????????,?,????????,?????

(?)???????????????????????????

?,?2????,??????,??????????????,???????????????????????/owa/auth/xxx/xx.aspx???????/owa/auth/xxx/yy.aspx,????????,?,????????

(??????????????????????????)???????????30???????????????????????????

??????????????,???????????????????,?,?????????????SSH?SMB??????30????????????????????????????????????????????????????;?,?????????????????????????????????????????????????????????????????????????????????????????,?????????????????????websocket+SSH??????????,???????????????,?WeChatxxxxxxxx.exe???????2????PIPE??????????,???????

?????????????????????

(?)?

???????????????????????,????????????????????????,????????,???????????,??????????????,???????????????????????????????????

(??????????)???????

???????????????????????????3?????,????????????????????????,2023????????????5???????????????2????????,??(95.179.XX.XX)??????????????,?????,??,????????????,??????????????????????????????“????????”?“???????”?“?”?“????(?+???????????)”?“?????????IP????”?“???”??

(?????)??????

??????????????????????,???????,2023?7???????????26???????????,??????????????(65.21.XX.XX)???????????????????,????,?,??????,????????????1.03GB?????????????,???????“???”????????????“tip4XXXXXXXX.php”?

(?)??????

?????????????????????????????????,????????????????,????,?????????????????????????SSH??,????,?????

???????????????????????????????????????????

(????)??????????

????????????,?22??????????????????????8?,???????????10??20?,???????????,??????????

(???????????)???????????????????????

2023??????5?2023?????????????????10??????????????,?????30?????????????,?IP?????????,???

(??????????)?

??????????2??PIPE???“c:\windows\system32\”?,??.net??,?,??KB,?????TLS?????????????????????????????????????????????,?https???,???????????????????????????websocket+SSH????????,????

?????????????????IP?????????

??????????????:??????