????1?????????????????17??????????????? ????17??????????????????,?????????????????

???

2024???12??????????18????????????????,??????????????CNCERT?????????????(

?????????????????????

(?)???????????????????????

2024???8?????????19??????????????,??????????????????????,?/??2024??????????????????????????8?21??????????????,????/????????????????

(????????????)??????????????

2024??????8???21?12?,????,???????????????????,????????????????,????/xxx/xxxx?flag=syn_user_policy??,?/xxx/xxxStats?

(?)???????????

2024?????11?6??????2024??????????11?8??2024???????????????11?16?,?276??????????????????????????????????????

??????????????

(??????????)??????????????

?IP?,?,??????????????????????????????,??,???

(??????????)?????????????

2024?11???????????6?11???16???????????????????????????,???3???????????????????IP??????????????????????????,?????????????????????????????????,?,???????????,???????,??????????????4.98GB?

????????????????

(??????????)??

?????,???????????????22?????????????8?????,??????10??20????????????????????,????,??

(??????????)??????????????

?5?IP??????,??????????????,??

(???????)?????????

???????????????????,?????????????????,???????????????

???????????????????????,????,???

(?)????????????????????????

??????,????????????????????????,?????????????????????,??????276?,???????????????,????????????????????

??????????IP????????????????????????

?????????

2024?12?18???????????????????,?CNCERT???????(

???????????

(??????????????)???????????

????Exchange?????????????????????????2???Exchange????,??????????????????????,???????????????????????,?????

(??)??????

???????,????2??????????,???????????????,???????????,????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????????????,????????????,???????????????????

(?)??????????30?????????????????

??,??????????????,??????,??SSH?SMB?30??????????????????;????,??????????????????????????????????????,???????????????????????websocket+SSH?,????????????,??????????WeChatxxxxxxxx.exe?????2????PIPE??????????????,??

????????

(?)?

?,?????????????????,?,?,????????????????????????????,???????????

(???????)?????????

???????????????????????3??????,???????????????,2023?????5??????2??????,????????????(95.179.XX.XX)??,?,??????????,??????????????,?“?????????????”?“?????????”?“???????”?“????(???????????+??)”?“???????????????IP??”?“????????????”??

(?????)?????

???????????????,??????????????,2023????????7?26?????????????,????????????(65.21.XX.XX)??????????????????????,???????????,?,?,????????1.03GB?????????????????,???????“???????”?????????????????????“tip4XXXXXXXX.php”?

(??)????????

?????????,????????????????,?????,????????????????????????????SSH??????????????????,?,??

???????

(????????????????)?

??????,?22?8????????????,???10???20??????????,???????????????????????????,??????

(?)?

2023?5?2023??????10??????????????,???????????30??????,????IP????????????????????,?????????

(???????????????)?

???????????????????2??????????????????????PIPE?????????“c:\windows\system32\”???????????????????,?????.net????,???????????????????,?????????????KB,???????????TLS?????????????????????????????????????????????????????,?https?????????????????,???????????????websocket+SSH??,??

????????????????????????????????????IP???????????????????????????

??:???

??

??:???????????,??????????,??????????????