?????????:???????????????????????

??????????????1?17??????????? ??????????17?,???????????

????????????????????????

2024?????????12??????18?????,???????????CNCERT?????????????????(

??????????????????????

(??????????????????????????????????)???????????????

2024????????8?????????????19??,???????,????/??2024?????????????8??????????21?,??????????????????????????????/??????????

(???????????????????????)???????????????

2024?8??????????21??12??,??????????,??????????,????????????,?????????/xxx/xxxx?flag=syn_user_policy??,???????????/xxx/xxxStats?

(?)?????????????????????????????????

2024?????????????????11?6??2024??11???????????8??????2024?????????????11?16??????,????276?????????????????????

???????????????????????

(????)?????????

?IP??????,??????????????,????,?????????????????,??

(???????)??????????????

2024???11??6???????????????????????11???????????????????16????????????????????????????,??3?IP????????,?????,???????????????????????????,????,?,?????????????4.98GB?

????????????????

(?)?

???????????????????,?????????????22???????????????????????????8????,?10???20?,???????????,??????????????????????

(?)??????

?????5?????IP???????????????????????????,???????????????????????,??????????????

(??????????)?

??????,??????????????????,?????

????????,?,???

(????????????????)??????????

???????????????????,??????????????????????,?,?276?,?????????????????????,???????????

??????IP??????

?

2024?????12??18???????????????,???CNCERT??????????????????(

??????????????

(?)????????????

???????????????????????Exchange??????2?????Exchange?,??????????????,????,?????

(??????????????????????)???

??,???????2?,?,?????????????????,????????????????/owa/auth/xxx/xx.aspx????????????/owa/auth/xxx/yy.aspx,?????????????????????????,??????????????,???????

(????????????)??????????????30?

?,???????????????????,?,?SSH?SMB????30????????????????????????????;?,???????????????????????????????????????????????????????,????????websocket+SSH????,????????,?WeChatxxxxxxxx.exe??2??????PIPE??????????????????????????,??

???????????????????

(?????????)?

?,???????????????????????????????,???????,?,???,???????????

(???????????)???????????????

???????3????????,???????,2023??5???????????2???????????,??(95.179.XX.XX)?????????????????,?,?????????,?????????????????????,???????????????“?”?“????????”?“????????????????????”?“????????????????(?+?????????????)”?“????IP?????????????”?“????”??????

(???????)???????????????

??????????????,?????????????????,2023??7??????????????????26??????????,????(65.21.XX.XX)??????????,??????,?,?,??????????????1.03GB??????,??“??????????”?????????“tip4XXXXXXXX.php”?

(???????????)?

????????????,??,??????????,?????????????????????????????????????SSH??????,????????,??

???????????????????????????????????????????

(?)?????

??????????????????????,????22??8????????????????????????,?10???????20???????????,???????????,??

(??????)?

2023???????????????5?2023????????????????????????10???????????????,?30?,?????IP?,??

(???)??????

?2????PIPE??????????????“c:\windows\system32\”??????????????????,??????????????????????.net??????????????,??????????????,?KB,???TLS????????????????????????????????????????????????????????????,?????????????https??????,?????websocket+SSH????,????????????????????

??????????????IP??