???????????????????????:?????????

?????1???????????17??????? ??????????????????????17?????,?????

????

2024?????12?????????18?????,??????????????CNCERT?(

??????????????????????

(?)????

2024??????8?19?,?,??????????/??2024???????????????8??21??????????????????????,??/??

(??????????????????)????????????????????????

2024?????????????8?21???????12??,???????????????,?,????????????????????????,?/xxx/xxxx?flag=syn_user_policy??,??????/xxx/xxxStats?

(??????)?

2024??????????????11??????6??????????????????2024????????????????????????????11???????????8?2024??11?16?,????276??????????????????

???????

(????)???????????????????????????

???????????IP??????????,???????????????????,?,??????????????,??

(????????)??????????

2024????11??????????????6?11??16???,????3??????????IP??????,?????????????????,???????????,???????????????,?,??????????????????????????????????4.98GB?

???????????????????????????

(????)???????

???????????????,???22???????8??????????????,??????????????????????10??20?????????,?????,??

(?)?

?????????????????????5????IP??????????????????????????,?,??????????????????

(????????????????)?

???????,??????????????????????????????????????????????????,???

???????????????????,?,??????????

(???)???????????????????????

???????????????????,??,?,?276??????????????,???,????????????????????????????????????

??????????????????????????????IP??????????????????

??????????

2024??12???????????????????????????18?????????,????????CNCERT??(

???

(?????)??????

???????????Exchange????????????????????????????????2???Exchange?????????,??,??????,??

(???????????????)?

?,??????????????????????????????????2????,????,??????????,????????/owa/auth/xxx/xx.aspx???????/owa/auth/xxx/yy.aspx,????????????????????????????????????,???????????,??

(??????)????????30????

?,?,??,???????????????????SSH?SMB???????????????????????????30????????????????????????;?????????????,???????????????????????????????????????????????????,???????????websocket+SSH????,???????,?????????????WeChatxxxxxxxx.exe?????????????????????????????2???PIPE?,??

???

(?)???????????

?????????????,??????????????????,??,???????????????????,??,???????????????

(?)???????????????????????????

??????????3??????????,???????????,2023?5????????2??????????????,?????????????????(95.179.XX.XX)????,??,???,?,??????????“?”?“??????”?“?”?“?????????????????(??????????????+????????????)”?“???????????????IP?”?“????????????”???????????

(???????????????)???????????????

??????????,????????????????,2023??7??????26??????????,?????????????(65.21.XX.XX)????????????????????,???????,????,???,??????????????????????1.03GB??????????????,??????“???????????????”?????????“tip4XXXXXXXX.php”?

(??????)?????????

??,??????????,????,??????????????????????????????????????????SSH?,?????,???????

?????????????????

(???????????)?????

?????,????22???????????????????8????,?10???????20?,?,?????????????????????????

(?)?

2023?5??2023?10????????,???????????30?,?IP????,??????????????????????

(???????????????????????)????????????

??????????2??PIPE??????????????“c:\windows\system32\”???????????????,?????????????????????????????????.net?,?????,????????????????????KB,?TLS???????????????????????????????????,????????https?,???????????????websocket+SSH????,?????????????????

?????????IP?????????