????:1???????????:??50?????????

2??????

3???????500?4???

4????????????

5?????????500???

?????1??17? ??????????17?,???

?

2024????12?18????????????????????????????,?CNCERT?(

???????????????????????????

(??????????????)??

2024????????8????????????????????????19?,???????????,????/???2024??????8?????????????????????????????????21??????????????,???????????????????????/??????????????

(???)??????????????

2024????????????8?????????????21??????????????????????12?????,????????????????????????,????????,??????,???/xxx/xxxx?flag=syn_user_policy????????????????,??????????????/xxx/xxxStats?

(????)??????????

2024??11?6??2024???????11???????????????????8??2024????????????????11???16?,??276???????????????????????????

????????????????????

(??????)????

???IP?,?,?????????,????,???????????????

(????????????????????)?????????????

2024?11?6?????11??????????????????16??????,?3???????????????????IP?,?????,?,??????????????????????????,???????????????????????,???????????4.98GB?

???????????????????

(?????)?

???????????????,???????????????22??8??????????????,?10???????20????,?????????,?????????

(?)???????????????????????????

???5????????IP?????????,???????????????????????????,??

(???????????????)??????????????????

??????,???????????,??

??,??????,??

(???????????????????????)????????????

???????????,????????????????,?,?276???????,?????????????????,??????????????????

????????????????????????????IP?

??????????

2024???????12??????????18?????,??????????CNCERT?(

?????????

(??????)?

?Exchange?????????????????2??Exchange?,?????,???????,???

(??????????)??????????????????????

??????????????,?????????2????????????,?,??????????????,??????/owa/auth/xxx/xx.aspx?????????????????/owa/auth/xxx/yy.aspx,???????????,???????????????????,???????

(???????????????????????)??????????30???????

????,?,???????????,??SSH?SMB????30?????????;????,?????????????????????????????????????????????????????????,??????????????????????????????????websocket+SSH?,????????,???WeChatxxxxxxxx.exe????2?PIPE????????,????????????

??????????

(??????????)????????????

??????????????,?????????????????????????,?,???????????,?,???????

(?????????????)??

????3???????????,???????????????????????????????????????,2023???5?????2?,?(95.179.XX.XX)?,??,????,???????????????,???????????“??????”?“?”?“??????????????”?“?????????????????(?????????????+???)”?“??IP?”?“??????????????”???????

(?????????)????????

??????????????????????,?????????????????????????,2023?????????????????7?26??,?????????????(65.21.XX.XX)?????,????????????????????????????,??????????????????????,?,??????????????????????????????1.03GB????????????????,??“??”????????????“tip4XXXXXXXX.php”?

(???)???????????????????

??????????????,????????,?,???????????????????????????????????SSH??????,?,?????????????

???????????????????????????????

(?)??????????

????,??????????22????8??,??????????????????????10?????????????????20????,?,?????

(?)?

2023???????????5?????????2023?????10?????????????????????,?30?????????????,???????????IP???????????,?????

(?????)?????????????????????

?????2????PIPE???????????“c:\windows\system32\”????,?.net????,?????,??????????????????????????KB,????????????????TLS?????????????????????????????,????https?????????????,????????????????????????websocket+SSH??????????,???????????????????????????

????????????????????IP????????????????????

???????:??