?????????:???????????????????????

?1????????????????????????17???????????????? ??????????????17???????????????????????????,??????

??

2024???????????????????????12?????18??????????????,?????????????CNCERT????????(

??????????????

(???????????????????)???????????

2024?8?????????????19?????,?,?/??2024?8???21???????????,??/??????????????

(?)?????????

2024??????????????8?21???????????????????????????12????,??????????????????????,?,?????????????????,??????????/xxx/xxxx?flag=syn_user_policy????,????/xxx/xxxStats?

(????)?

2024???????????????11?????6?????????????2024???????????????11?????8??????????????2024????11????????????????????????16?,????276???????????????????????????????????????????????????????????

???????

(???????????)??????????????????????

?????????????IP???????,????????????????????????,??,?,?????????????????

(???????)????

2024?11??6???????????????????????????11????????16??????????????,?3???????IP???,?????????,??????,??????????????????,???????????????????,????????????????????????????????4.98GB?

???????????????????????????

(?)????

?,?22?????8?,????????????????10??20????????,?,???????

(?????????????????)????????????????????

???????5????IP?,?,?????

(?)????

?????,????????,??????????????????

?????,??????,????????????????

(??)????????

?,??,?,???276??????????????????,?????????????????,?????????????

????????????????????????????????????IP??????

??????

2024?12??????????????18??????,???????????????CNCERT???????(

???????????????????????????

(?)??????

???Exchange???????2?Exchange???,?,????????????,???????

(???)???????

??????????????????,??????2??????,??????????,????????????????,?/owa/auth/xxx/xx.aspx???????????????????/owa/auth/xxx/yy.aspx,?????????????????????????????????,?,???

(?)???????????????30??????????

???????????????????????,????????????????????????????,?,??SSH?SMB??????????30??????????????????????????????;??????????,??????????????????????????????,???????????????????websocket+SSH?????????????????,????????????????????????????????????,???????????????????????WeChatxxxxxxxx.exe???????????????2???????????PIPE??,???

?????????????

(????????)???????????????

???????????,?????????????????????????????????????????????,???,?,????????????????,??

(??????)??????????

???????3??????????,?????????????????,2023?????????????????5?2??????,????(95.179.XX.XX)?????????????,?,???????????,????,?“?”?“??????????”?“??”?“?(???????????????+??)”?“????????????????????????????IP??????????????????????”?“?”??????

(??????????????????????????????????)??????????

??????,????????????????????????????????????,2023?7?????????????????????26?,?????????????????????????????????(65.21.XX.XX)???????????????,????,????????,??????????????,??1.03GB??????,?“?”???????????????????“tip4XXXXXXXX.php”?

(???)?????????

????????????,????,??????,????????????????????????????????????SSH?,??????????,??

????????????????????????????

(?)??

??????????????,????????22???????8?,????????????10??????20????????????,?????,??

(?????????????)????

2023??????5??????????2023?10????,??30???????????????????,?IP??????????????,??????????

(?)???????????

????2??????????PIPE?“c:\windows\system32\”?????,?.net??,????????????????????,????KB,?TLS??????????????????????????????????,??????????????????????https?????????,???websocket+SSH?,??

??????????????????????IP?