???????????1?17??????? ??????????????17????,???????????????

?

2024???????????12?18??????????,????????????CNCERT????(

?????????????????

(??????????)???

2024??????8????????????????19???????????????,?,?/???????2024???????8???????????????????21??????????,?/??

(????)??????????

2024?8??21????12??????????????,????????????????????????????????????,????????????,???,??????/xxx/xxxx?flag=syn_user_policy??,??????????????/xxx/xxxStats?

(?????????????)?

2024????11??????????6????????????????2024??????????11????????????8????2024?11???????????16????????,????276?????????????????????????????

???

(????????????)???????

??IP?????????????????,??????,??????????????,???????????????????????????,??????????????

(??????????????????)??????????

2024??11?6?????11?????????16?,????3??IP???,?,????,????????????????????????,?,???????????????????????????4.98GB?

?????????????????????????????

(??)????????????????????????

?,?????22?????8?,????????10?20?????,?,??????????

(????)?

?5?????????????????????IP???????????????????????????,??????????,???

(?????)?

?,??????,??

????????????????,??????,????????????????

(??????????)?

??????,????????????????????,?????????????,????????276??????????????,????????????????????????,???????

???????????????IP??????

?????????????????

2024????????????????????????????12???????????18??????????,???????CNCERT??????(

??????????????????????????????

(??)?????

?????????????????????????????????Exchange?????????????2?Exchange??,?,???,??????????

(???)??????????????????

?????????????,?????2??,?????????????,???????????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????????????????????????????????,????????,?????

(????)?30????

?,?????,???????????????????,??????????????SSH?SMB?30??????????????????;?????????????,???????????????????????????????????????????????????????,??????????????????????????????????websocket+SSH???????????????????,????????????,?WeChatxxxxxxxx.exe???2?????????PIPE??,??

????????????????

(????)?

??,?????????????????,????????????????,?????????,??????????????,?????????????????

(??????????)????????????????????????

????????3???????????????????????,??????????????????????????????????????,2023??????5?2??????,?(95.179.XX.XX)??,?,?,?,????????“?”?“?”?“????????????”?“????(??????????????+????????????)”?“??????????????????????IP???????????????”?“????”?????

(????)?

???????????????,?????????????????????,2023?7?26?,?(65.21.XX.XX)???????????????????,?,????????????,??????,??????????1.03GB????????,?????“??????????????????????”?“tip4XXXXXXXX.php”?

(??)??

???????,??????????????????????????????,??,?????????????????????????????????SSH????????,??????????????,????????????????????????

????????????????????????????????????

(?????????????)?????????

??,????????????????????????????22?????8??????????????,?10??????????20????????????????????,?????,????????????????????????

(????????????????)???????????????????

2023??????????????5?2023???????????????10??????,?30?,?IP????,??????

(?????????????????????)?????

??????2??PIPE?“c:\windows\system32\”?,???????.net??????,???????????,????KB,?????????TLS?????????????????????????????????????????,????????????????????????https?????????,???websocket+SSH???????????????????????????,??

?????????????????????????IP???????

????????????????????????:????????

??

??:???????????,??????????,??????????????