???????????????????????:?????????

?1?????????17??????? ????????17???,????????????????

??????????????

2024????12?18????,?CNCERT???(

?????????????????????

(?)????????????

2024????????????8?????????????19?,??,?/?????????????????2024?????????????????8??????????????????????21???,?/?????????????????

(??????????)?

2024??????8??21??????12?????????,????????????,??????,?????????????,???????????????????????????/xxx/xxxx?flag=syn_user_policy?????????,????????????????/xxx/xxxStats?

(?????????)?

2024??11???6????????????????????2024??????11?8??2024???????????????11???????????16???????????????????,?276???????????????????????????????????????????????????????????????

??????

(??????)???????????????????

?IP?,??????,?,?,??

(???????)??????????????

2024????11?6?????11??????????16??????????????,????3???IP?????????????,?,??,????,?,?????????????????????????????????4.98GB?

???????????????????????????????????

(?)?

?,???22?8????????,????10????20????,?????,?????

(????????????)?????

??????5????????IP?,?????????????,??

(??????????????)?

???????????????,???????????????????????,??

??,??????????????????,?????????????????

(??????????????)??????????

?,??????????,????,?276??????,?????????????????????????????????,????????????????????????????????

??????????IP?????????

???????

2024?12?????????????18?????,?CNCERT????????(

?????????????????????????????

(???????????)???????

?????????????????Exchange???????????????????????2?????Exchange??????????,?????,??????,??

(?)??

???????????????????????????,????2?????????,???????????,????????????,??????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????????????????,??????,??????????

(???????????????)???????????30??

??????????,????,???,????????????SSH?SMB???????????????????????30???????????????????????;???????????????,??????????????????????????????????????????????????????????????????????,??websocket+SSH????????,???????????,?????WeChatxxxxxxxx.exe??2?PIPE??????????,???

??????????????????????

(?)?

??????????????????????????????????,???????????????????????,?,???????????????????????,?,???????

(?????????????????)??????????

?3???????????????????????????,???,2023????????????????????????5?2???????????????????,???????????????????????????(95.179.XX.XX)????????????????????????,???????????????,?????,???????,???????????“???????????”?“???”?“?????”?“??(???????+??????????????)”?“????????IP?????????????”?“?”??????????????????

(??)?????????

????,?????????????????,2023???????????????????7?26?,??????????(65.21.XX.XX)?????,?,?,????,??1.03GB???????????????????????,?“????”????????????“tip4XXXXXXXX.php”?

(???)?

??????????,????????????,????,???????????????????SSH????,???????????????????????,????????

?????????????????????

(?)???????????????

??????????????????,???????????????22????8???????,????10?????????????20?,????,???

(???????)??????

2023??5?2023????????????????????????????10?????????????,?30??,??????????????IP?????????????,??????

(???????????????????)??????????

??2?PIPE??????????????“c:\windows\system32\”??????????????????????????????,????????????????????????.net?,?,???????????KB,?????????????????TLS????????????????????????????????????,?????????????????????????????????https??????,??????????????????????websocket+SSH??,??

??????????????????????????IP?