???????????????????????:?????????

????:?????:??????100????

????1???17??????????????????????????? ???????????17???????????????????????,???????????????

???????

2024?12????????????18??????????,????????CNCERT????(

????

(?????????)?

2024?8???????????????????19?,?????????,??/???2024??????8???????????21?????????,???????/????????????

(???????)????????

2024??????????????8????????????????21????????????????????????????12?????,??????????????????????????????????????????????,???????,??????????????????????????????????????????????,??/xxx/xxxx?flag=syn_user_policy??,???????????????/xxx/xxxStats?

(????????????)??????????????

2024??????11??????????6?????????????2024???????????????11????8???????2024??????????????11????????16?,?276??????????????????????????????

??????????????????????????????????

(???????????????????????????)??????

???????????????IP????????????????????????,?????????????????,?,??????????????,????????????????????

(??????????)????

2024?11???????6??11?????16????????????????????????????,???????????????????????????3??????????????????????????????IP????,?????????????,??????????,????????????,????,????????????????4.98GB?

??????????????????

(?????????????????)????

?,???????????22???8???,??10????20????,?,??

(?)?????

???????????????????5?IP??????,??????????????????????,??

(????)???????????????????

????,????????,???????????

???????,????,??

(?????)??????????

?????,????,??,??????276?????,????,????????????????????????

????????????????????????IP?

??????

2024?12????18?,???CNCERT?(

??????????????????????????????

(?)?

????Exchange?????????????????????????2?Exchange?,?,?????,??

(?)?????

???,?2??????,???,????????????????,???????????????????/owa/auth/xxx/xx.aspx??????????????????/owa/auth/xxx/yy.aspx,??????????????????,?,??????

(??)????????30??????????????

????????????????,??????????????,?????????????????,????????????SSH?SMB?????????????30????????????????????????????????????????;?,?????????????????????????????????????????,?websocket+SSH?,????????,???????????????WeChatxxxxxxxx.exe???2????????PIPE???????????????,??

???????????????????????????

(?)?

?????????????????,????,?????????,??????,?,??????????????

(???????????????????????)?

?????????????3?????????,???????????????????????????????????????,2023?5?2?????,?(95.179.XX.XX)????,????????????????????,?????????,?,?????“??”?“???????????????????????”?“????????????”?“????????????????????????(?+??)”?“?????IP??????”?“??????????”???????

(????)???????????

?????????????????,??????????????????????????????????????,2023????????7?????????26????????,?????????????(65.21.XX.XX)??????????,?,???????????????????????,?????????,??1.03GB??,?“?”?“tip4XXXXXXXX.php”?

(???????????????)???????????

?????,????,???????????,??????????????????????????????????SSH?,?,?????

???????????????

(?)?????????????????????

????????,?22???????????????8?,???????????????10?????????????????????????????????20??????????,?,???

(???)?

2023???????????????????5?2023?10?,????????????????30???????????,?IP????????????????????,???????????????????

(?)??????????

??????????2?PIPE??????????????????????????“c:\windows\system32\”???????????,???????????.net???????,?,?KB,??TLS????????????????????????????????????????????,?????????????https??????,???????????????websocket+SSH??????????????,??

?????????????????????IP?

????????????:???????????????