???????????????????????:?????????

?1??????????????????????17? ?17??????????????,??

???????????????????????????

2024???????12???????????18??????????????,????CNCERT??????????(

?????????????????????

(?)??????????

2024??????????8????????????????????????19?????????????,???????????????????,??????????????/?????2024??????????????8???????????21????????????,??????????????????????????/???????????

(????)??????????

2024????????????????????8??????21??????????????12????????,??????????????,?????????????,????????????????????????,???????????????/xxx/xxxx?flag=syn_user_policy????????????????,??/xxx/xxxStats?

(??????)??????????????????????

2024????11?6??????2024?11?8?2024?????11???????16???????????????????,???????????????????????276???????????????????????????????????

????????????????????????

(?)???????

?IP??????????????????????????????,????????????,??,?,????????????

(???????????)?????????????

2024?11?6?11?16?????,?3??????????????????????IP????,?,?????,????????????????????????,?,??????????????????????????4.98GB?

???

(?????????????????)???????????????

?????????,?22??8?,?????????10??20?,????????,??????????

(??????????)??

???????????????????????5???????????????????IP????,?,??????????

(???????????????)?

??????????????,?????,??????

?,????????????????,?????

(????)?

?,???????????????,????????,???276????,??????????????????????????,??????????????????????

?????????????????IP?

??????

2024??????12??18?????,????????????CNCERT??????????????????????????(

???

(?)??????

???????????????????????????Exchange?????????????2????????????Exchange???????????,?,???????????????????,????????????

(??????????)?

?????????,???????????2????,????,?????,?/owa/auth/xxx/xx.aspx??????????????????????????????????/owa/auth/xxx/yy.aspx,?????????????????,??????,?????

(?????????????????)??30??????????????

?,??,?,???SSH?SMB?????????????????30???????????????????????????????????;????????????????????????????,?????????????????????????????????????????????????????,?????????websocket+SSH????????,????????????,????????WeChatxxxxxxxx.exe??2??????????????PIPE?????,??????

??????????????????

(????????????)??????

??????????,?????????????????????????,???????????????????,???,?,?????

(?)???????

???????3???????????????????????,??????????????????????????,2023???????5?????2????,??????(95.179.XX.XX)?,?,????????????????????????,?,??????????????????“?????”?“??????????????????????”?“??????????”?“?????????????(???????????????????+?????)”?“?IP?”?“???”??

(??)??????

????????????????????,???????????????,2023??????????7?????????????26????????????????,????????????????(65.21.XX.XX)?,??,?,??,??????????????????1.03GB???????????,?“???????????????????????”????“tip4XXXXXXXX.php”?

(??????????????)?

??,?????,???,??????????????????????????????????????????SSH?????,???????????????,??

??????????????

(????????????)???????????????????????????

?,??22??????8??,?????10?????????????????????20?????????,???????,??????

(?????????)?

2023??????5?2023?10????,?30?,??????????????IP???,???

(??????)????????????????

????????2?PIPE??“c:\windows\system32\”?????????????????,????????????????????????????.net??,????????????????????,??????????KB,?TLS??????????????????????????????????????????,????https?,??????????????????websocket+SSH?????????????,??????

??????????????????????????IP??????