?1????17?????????? ??17?????????????????????,?????????????????

??????????????

2024??12????18?,?????????????????CNCERT????(

?????????????????

(???????????????????)????????????????

2024????????????????????????8??19???????????????,????????????,???????????????????????/???????????????2024?8??????????21??????,??????????????????????/?????????????

(?)??????

2024??????????????????????8???????????21??????????????12????,?????????,?,??????????????????????????,???????????????????????????/xxx/xxxx?flag=syn_user_policy?????,?????????????/xxx/xxxStats?

(???????)?

2024?11???????????6??????????????????????????????????2024??????????????????11?8??????????2024??11??16?????,???????276???????????????????????????????

????????????

(?)????

??????????????IP?,???????????????,???????????????????,????????????????,??????

(???????????)??????

2024?11?????6???????????????????????11??????????????????????????16??????,????????????????????????????3?IP????????????????????????????,????,???????,??????????????????????????,????????????,??????????????????????????4.98GB?

????????

(??)?

????,?????22??????????????????????????????8?,????????????????????10??20?,??,???????????

(????)?????????

?????????5?IP????,?,??

(??)????????????

???????,??????????,????????????????????

??????????????,?????????????????????,????

(???????????????????????)????

?????????????,????,???????????????????,????276??????????,????,????????????????????????????

?????????????????????IP??

???????????????????????????

2024?12??????????18????????,?CNCERT????????(

???????

(?)??????

???????????????????????Exchange???????????????????????2?Exchange???,?????????,????????????,??

(?????????)????????????????

????????????,????????2?,??????????????,???????????,???????????/owa/auth/xxx/xx.aspx??/owa/auth/xxx/yy.aspx,??????????????????????????????,?,????????????????????????????

(?)?30?

???,????,???????????,??????????????????????????????????SSH?SMB??????????????30???????????????????????????;????????????????????????,????????????????????????????????????????????????????????????????,?????websocket+SSH???????????????,??????,??????WeChatxxxxxxxx.exe??????2????????????????????PIPE??,???????

???????????????

(?)?

?,????????????????????????????,?????????,?,???????????,????????????

(????????????)?

?3??????????,???,2023??5???????????2??????????,???(95.179.XX.XX)?,?,?,?,???“??????????????????”?“??”?“???”?“???????(???????????+?????????????)”?“???????????IP??????????????”?“?”??????????????????

(??????)?

????????????????????????????????,???????????????????,2023???????7???????????????26?,?????(65.21.XX.XX)???????????????,?,?????????,?,????1.03GB??,?????????“?”????????“tip4XXXXXXXX.php”?

(?)??????????????

?????,???????,?,?????????SSH?,?,??????????

??????????????????????????????????????????????????

(??????)????

??,??22???????????????????????8????,??10??????20?,?????????,????????

(????????????????)?????????????

2023??????????????????5????????2023?10?,??????30?????????????,?IP?????????????????,???????????????

(?????)?

?2?PIPE???“c:\windows\system32\”???????????????,??????????????.net??,?????????????,?????????????KB,??????TLS???????????????????????,?https??????????,?websocket+SSH??????????,????????????????????

??????????????IP?

?????:????????????????????

??

??:???????????,??????????,??????????????