?????????:???????????????????????

??1?????17???????????????? ?17????,????????????

????

2024??????????????????12??????18??,????????????????????????CNCERT?(

???

(??????????)????

2024?8?19??????????,?????,????????????????????????/????????????2024????8????21?,?/????

(??)?

2024???????????????????8??21???12???????,?????????????????,??????????????,????????????,????????/xxx/xxxx?flag=syn_user_policy??,?/xxx/xxxStats?

(??????)?

2024????????????????????????????11????????????????????????6??????????????2024?????????????????????11??????8??????2024?11??16????????????,????276????????????????????????????

??????

(???????????)???????????????????

???????????IP?????????????,???????????????????????????,?????????,??????????,????????????????????

(??????????)?

2024???11????????????????????6??????????????11??16??????,?????????????3?IP?????,???,??????????????????????,????,????????????,?????????????????????????????????4.98GB?

???????????????????

(???????????????)???

???????,?????????????????????22?8?????????????,????10?????????20?,?,???

(??????????????????????????)?????????????????

?5????IP?,?,?????

(?????????)??????????????

???,??????????????????,???????????????????????

?,?,???????????????????????????????????

(?????????????????)?????????

???????,?,?????????,???276????,???????????????????,??????????????????

??????????IP?

????

2024?12?????18?,??CNCERT????(

??????????????????????????????????

(????)?????

???????????????Exchange?????????2????????Exchange???????????????????????,?????????????,??,???????????????

(?)????????????????????????????

???????????,???????????2?????,??,??????????????????????,??????????????????????????????/owa/auth/xxx/xx.aspx?????????????????/owa/auth/xxx/yy.aspx,???????????????????????????????????????????,???????????????,????????????????????

(???????????)???30?

????????,?,???????????????????????,?SSH?SMB??????30????????????????????;????,???????????????????????????????????????????????????,??????websocket+SSH??????????????,?????????????????????,???????WeChatxxxxxxxx.exe???????????????2????PIPE???????????????,??????????

????????????????????

(?)?????????????????

?????,???,?,?????,?????????,??

(?)??????

?3??????????????????,????????????,2023??????????5??????????????2???????,????????????????(95.179.XX.XX)??????,????????????,??????????,???????????????,?“????????????????????”?“???????????????????????”?“????????????”?“?????????(??+?)”?“?IP?”?“????”??????

(??????)???????????????????

???,????????????????????,2023???????7???????????????????26?????????,??(65.21.XX.XX)??????,????,???????????,???????????????????????????,???????1.03GB??????,????????????“?”???????????????“tip4XXXXXXXX.php”?

(??????????????)????????

?,????,??????????????,?????????????????????????????????SSH????????,???????????,???????????????

???????????????????????

(???????)???

??????????????,????22????????????8??????????????????,?10?20???????????????,?,???

(?)?

2023??????5?2023?10??,????????30??????????,???????????????????????????IP????,????????????????????????

(??????)?????????????????

?2?????PIPE??“c:\windows\system32\”?,?.net?????,?,????????????KB,?????????????????????????????????TLS???????????????????????????????????????,??????????????https?,??????????????????????websocket+SSH????????,??????

?????????????IP?