??????????1???????????????17????????????????????? ?17????????,????

???????????

2024?12???????????????18?????????,??CNCERT????????????????????????(

???????????????????

(?)?

2024?8?19?,?,?/?????????????????2024????8???????21???????,??????/????????????????????

(?)?

2024?????????8?????????????????????21?12?????,??????????????,??????????????????,??????????????,??/xxx/xxxx?flag=syn_user_policy???????????,??/xxx/xxxStats?

(????????????)??????

2024?????????????????????????????????11??????????????6?????2024???????????????????????11????8????2024?????????????11???16?,??????????????????276????????????????????????????????????????????????

????????????????

(?)???????

?IP????????????????????????,????????????????,?,????,???????

(??????????)??????????????

2024?11?6???????????????11??????16????,?3?????????????IP?,?????,?????,??????????????????,????????????????,?????????????????????????????????????????????????????????4.98GB?

?????????????

(??????????????)?

????????????,??????????????22??????????????????8??????,???????????????????10????20??????????????,??????????????,???????

(?)?????????????????

???5????????IP?,???????????????,????????????

(??????????????????????????????????)??

?,??????????????????????????????,???????????????

?????,??,??

(????)???????

????,?????,?,????????????????276???,????????,?????????????

???????????????????IP?????????????????

??????????

2024?12?????????????18?,??????CNCERT????????(

??????????????????????????????????????????????????????????

(?)???????????????

???????????????????????????Exchange????????2??????????Exchange?,?,???????,?????

(?)???????

?,????2????,?????,?????????????????????????,?/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,????????????????????????????,????,???????????????????????

(???????????????????????????)?????????????????30???????????????

?????????????,??,????,????????????????????????????SSH?SMB??????????30????????????????;???????????,???????????????????????????????????????,???????????????????????websocket+SSH????????????????????????????,???????????????????,??WeChatxxxxxxxx.exe???????????????2??????????PIPE?,????????????????????????

????????????????????????????????????

(???????????)?

?,???,??,?,???????????,???????

(?????????)?????????????

?3???????????,????????????????????????????,2023???????????????5????????????????????2????????????????????,?????(95.179.XX.XX)?,???????????????????,????????????,?,??“?”?“??????”?“??”?“?(?+????????????)”?“???????IP?”?“??????????????”??????????????

(?????)??

?????????????,????,2023????7???????????26???????????????????,??????????????(65.21.XX.XX)??????????,?,?,??????,??1.03GB????,????“??????????”??????????“tip4XXXXXXXX.php”?

(?)??????????????

?????????,???????????????????,???,?????????????????SSH??????,?????,?????

????????????????????

(?)?????????

???????????????????,?22???????8?????,???????10?????20??????????????????????,????????,?????????

(????????????)?

2023????????????????????????5?2023?10???????????????????????????,????30????????????,?????????IP???????????,??

(??????????????????????????)???

?2?PIPE????“c:\windows\system32\”?,??????.net???????????????,????,????????KB,??TLS??????????????????????????????,?https??????,??????????websocket+SSH??,???????????????????????

???IP??

??:?????????

??

??:???????????,??????????,??????????????