????:1???????????:????

2???????

3???????

4???????100?4???

5??????????

??????????????1?17?????????????? ????????????????????????????17?,???????????????????????????

???

2024??????12?18???????,?CNCERT??????(

?????????????????????

(?????????????)????????

2024???????????8??????19?,???????????????,??????/????2024???????????????8?????21?,????/????????

(???????????????)?

2024??8?????????21???????????????????12????????????????,???????,????????????,???????,?/xxx/xxxx?flag=syn_user_policy????????????????,????????/xxx/xxxStats?

(????????????)?

2024?????11??????6??????????????2024?????????????11??????????????8??????2024?????????????????11???????????????????????????16????????????????????????,???????????????????????????276???????????????????????????????

????????????????

(?????????)????????????????????????

??????IP??,???????????,?,??????,??

(?????????)?

2024?11??????????????6?11?16?,????????????????????3?????IP???????????????????,????,?,????????,?,????????????????????????????????4.98GB?

???????????????????????????????????

(??)???????????????????????

?,??????22??8???????,?10????20?????????????,???????????????????,?????????????????

(????)??

??????5?????????IP?,?,??

(?)?

????????????????,???,?????

????,??????????????????????????????????,??

(??????????????)?????????????????????

???????,?????????,?,??276?,??????????????,????????

?????????????????IP?

???

2024?12????18?????????????????????,?CNCERT??????????????(

??????????????

(??)??????

??????????????????????Exchange???2???Exchange?,??,???????????,??????

(?????????)?

????,???????2?????,???????????,?????????????????????????,????????/owa/auth/xxx/xx.aspx?????/owa/auth/xxx/yy.aspx,???????????,??????,??????????

(??????????)????30???

??????????,??????????????????????,?,???????????????????????SSH?SMB????????????????????????????30?????????????????????????????????;??????????????????????,??????????????????????????????????????????????????,?????????websocket+SSH?????,?????,??????????????WeChatxxxxxxxx.exe???????2?????????PIPE?????,?????

???

(?)???????????

??????????,???????????????????????????,?,???????,??,??

(?)?????

?????????????3???,?????????????????????????????????????????????,2023?5???????????????2??????????,???????????????????(95.179.XX.XX)?,???????????????????????,?,??????????????????????????,?“?”?“??????????”?“????”?“??????(???????????????+???????)”?“??????????IP?”?“???????????”??

(????????????????)????

??????????????????????????,???????????????????????????????????????,2023???7??????????????26?,??????????????(65.21.XX.XX)???????,??????????????????????????????,?????,????,????????1.03GB????????????????,???????????“??????????????????”????“tip4XXXXXXXX.php”?

(???????????????????)?????????

???????????,??,??????????????,??????????????????????????????SSH????,?,??????????????????

???????????????

(?)?????????????

???????????,?22??8???????????????,?????10?????20?,?????????????,???????????????????

(????????)???

2023????????????????????5???????????2023???????????????????10??????????????,??30??????????,??????????????IP????,???

(????????????)????????????

??????????2???PIPE?“c:\windows\system32\”????????????????,??????????.net??????????,??????????,??????????????????????KB,???????TLS?????????????????,?https????,????websocket+SSH????????????????????????,?????????????

??????IP??

??????:???????????