???????????????????????:?????????

??

?????1???????????????????????17???? ????????17?,???????????

?????????????

2024??????12?????????18?,????????CNCERT???????????(

???????????

(?????????)????

2024?8????????????19??????,?,??????/???????????????2024??8????????????21????,?/???????

(??????)?????????

2024??????????????????????8?21???????????????????12??????????????????,?????,???,???????????????????????????,?/xxx/xxxx?flag=syn_user_policy??????????????????,????/xxx/xxxStats?

(???????????)??????????

2024??????????????????????????11??????????6??????2024??????????????11?8???????????2024?11?16?,????????276?????????????????????????????

????????????????????

(?)??

?IP??????????????,??????,??????????????,??,??

(???????????????)????

2024????11???????????6???11??16????,???????????????3?????????????????IP??,??,????????????????????????????,?????????????????????,????,???????????????????????????????????4.98GB?

????

(?????????????????????)??????????????????????????????????

?,?22????????????8????????????????????????????,???10??????????????????????????????20?,??????????,????

(???????????????????)???????????????

?5?????????????????????IP????,????????,???????????????

(?)??????

????,??????????????????????????????,????????????????

????????????????????,??????,?????????????????

(????????????????????????)?

???????????????????,??????????????????????,?,?276?????????,??????????????????????????????????????????????,????????????

???????????IP???????

??

2024?12???????????????????????????18????,??????????CNCERT??????????????????????(

?????????????????????????????

(?)?

??????Exchange???2?Exchange?????????????????,???????,?????,?????????????

(????)?

??????????????,????????2?????,????,????????????????,???????????????????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????????????????????????,????????????????,??????

(?)??????????????30???????????????????????

?,??????????????,????????????????,??????????SSH?SMB?30???????????????????????????;????????????,?????????????????????????????????????????????????,??????????????????websocket+SSH?,????????????,??????????WeChatxxxxxxxx.exe???????2????????????????PIPE???,???????

?????????????????????????????

(?????????????)??????????????????

?,??????????????????????????????,???????,????????????????,??????????,??

(?????)???????????????????????

?????????????3???????,????????????????,2023??????5??2?,?(95.179.XX.XX)???????,??,??????,???????????,?“?”?“?????????????”?“??”?“????(???????????????+???????????????????)”?“?IP??????”?“???????”??????

(?????)????

?????????????,??????????,2023????????????7???????????????26????????????????????????,?(65.21.XX.XX)?,?,?,?????????????,????1.03GB???????????,?????“?”???????“tip4XXXXXXXX.php”?

(???????????)??

??????????????,????,?,??????????????????SSH??,???????????????????????,?????

???

(???????????)??????????

??????????????????????????,?22???????????????????????????8?,?10???????20??,??????????????,??????????????

(??)?

2023?5???????????????2023??10???????????????????????,???????????30?,???IP?????,???

(??????????????????????)??

?????2?PIPE?“c:\windows\system32\”???,???????????????.net???????????,??????????,???KB,??????TLS?????????????????????????????,?https?,????????????????????????websocket+SSH??????????,??????????

??????????????IP????????

???:??

?????????

????????????????????????????:??????????????

????????