???????????????????????:?????????

??

??1???17??????????????????????????? ?????17??????,????????????????????

?

2024?????12??????????????????????????18?,??????????????CNCERT??????????(

????????????

(?????)?????????

2024????????8????????????????????19???,?,?/????????????????2024???????8?21?????????,?/?????????????????????????

(???????????????????????????)??????????

2024???????????????8???21?????????????????12?,??????????,?????,?????????????????,???????????????????/xxx/xxxx?flag=syn_user_policy??????????????,?????/xxx/xxxStats?

(?)????

2024????11?????????6???????????2024???????????????????11??????????????????????????????????8???????????????????????????2024?11???????16????????,???????????276?????????????????????

??????

(??)?????

??????????IP???????????????,????,???????????????????????,??,??

(??????)??

2024?11?6??????????11?16???,?3?IP?????,?????????,???,??????,?????,???????????????????????????????????4.98GB?

?????????????????????????????????

(??????)?????

??????????????????????,??????????22?8??????????,?????????10??????????????20?????????,????,??

(?)??????????????????

???????????????5????IP???????????,????????,??

(?)????????

?,????????????????????????,????????????

????,???????????,??

(?)????

????????????,??????????,?,????276?????????????????????????????????,???????????????????,????

????????????????????????????IP???????????????

??????????

2024????????????12??????????????????18????????????????,?CNCERT?(

?????????????

(????????????????)???????????????????????

?Exchange??????????????????????????????2???????????Exchange??,????????????????????????????,?,??

(????)??????

????,??????2?,?,?????????????????????,??/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????,?????,??????????????

(???????????)????????????30???????

????????????,????????????,????,??????SSH?SMB???????30??????????????????????????;????,???????????????????????????????????????????????,??websocket+SSH???????????????,????,??WeChatxxxxxxxx.exe??????????????2?PIPE??????????????????????,??????????

???????

(??????)??

???????,????????????????????????????????????,??????,?,?,???????

(?)????????????????????

??????????????3???????,??????????,2023?????5?????????????????2?,????????????(95.179.XX.XX)???????????????????????,???????????????,?,???,??????????????“???????”?“????????”?“?”?“?(?????????????+??????????????)”?“????IP??????????”?“?????????????”??????????????

(???)???????????????????

?????????????,?????????,2023???????????????????????????7???26???????????,?(65.21.XX.XX)??????????????,??,?,??????????,??????????????1.03GB?????,?“??????????????”????“tip4XXXXXXXX.php”?

(?)?????????????????????

???,????,???????????????,?????????????????????????????????SSH?,??,?????????????????

????????????

(?????????????????)????????????????????????

?,?22??????????8?,?10???????20?????????????????,?,??

(??????????????)??????????????

2023????????????????????????5????????2023?10????????????,??30??????????????????????,??????IP??????,??

(?)??

???????2???????PIPE?????????????????“c:\windows\system32\”??????????????????,??????????????????????.net????????????????,?????,????????????????KB,?????????????TLS?????????????????????????????????????,?https?????????,?websocket+SSH???????????,???????????????????????????

?????????????????????IP??????????

?????:????????????

?????????

????????????????????????????:??????????????

????????