?????????:???????????????????????

??????????????1??17???????? ?????17???????????,??????

??????

2024?????12?18?,?CNCERT?????(

??????????????????

(??????????????)???????????????

2024??8??????19???????,?,????????????????/???????????2024?8????21??????????,????/??

(?)??

2024????8??21??????????????????????????12????,??????????????,???????????,????,????????????????????????/xxx/xxxx?flag=syn_user_policy????????????????,?????????????/xxx/xxxStats?

(?????????????)?

2024????????????????????11????6????????2024?11?????????????8????2024??11??????????????16???????????????????????,???????276????????????????????????????????????????

??????

(???????????????????)????

?????IP??????????,?,??????????,???????????????????,???????????????

(????????????)?

2024???????????????????????11?6??11???????????16?????,??????????????????????3???IP??????????????,?,??????????????????,?????????????????,?????????????,??????????????????????????????????4.98GB?

???????

(??)??

????????,???????????????22?????8?,?????????????10?20??????????,??????????????,?????

(????)????

?5????IP???????????????????????????,?,???????

(??????????????????????????????)?

??????????,???,????????????????????????????

???????????,??????????????????????,??

(????????????)??????????????

?,?????????????,?????????????????????????????????,?276??????,?????????,??????????????????????????????

?????????IP?????

?????????????????????

2024?12????18??????,?CNCERT???????????(

?????????????????????????

(??????)?

???????????????????????Exchange????????????????????2?Exchange?,?,???????????????????????,?????????????

(?)?

?,????2???????????,?????????,?????????????????,????????/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,?????????????????,?????????,????????????????????

(?????)????????????30????

?????????,???,??????????????,??????????????????????????????????SSH?SMB?30??????????????????????????????????;?,?????????????????????????????????????????????????????????????????????????,?????????websocket+SSH???,?????????????????????????,??????????????WeChatxxxxxxxx.exe?????????????????????????2?????????PIPE?,??

??????????????????????

(???????????????????????????)????????????

???,???????,?????????,???,???????????,??

(?)?

?3?????????,?????????????????????,2023?????????????5??????????2??,?????(95.179.XX.XX)???????,???????????????,??????????,????????,?“??????????????????????????”?“?”?“???????????????????”?“????????????????(?+????????????????)”?“?IP?????????”?“???????????????”????????????

(???????)???????

????????????????????,????????????????????????????,2023????????7?26????,??????????????(65.21.XX.XX)????????????????????????????,???????,??????????,?,?????????????????????1.03GB?????,????????????“?”??????“tip4XXXXXXXX.php”?

(???)?

???????????????,??????,??,??????????????????SSH?????,??,???

???????????????????

(????????????????)??

??,?22???8?,????????10???20??????,??????,????????

(?????????)?

2023?5??????????????2023????????10?,???????????????????30??????????????????????,???????????IP??????,??

(?)?

????2??PIPE??“c:\windows\system32\”?,??????????????????.net????????????????????,??????????,?KB,????TLS??????????????????????????????????????????????????,?https??????,????????????????????????websocket+SSH?????,????????????????????

?????????????????IP?????