???????????????????????:?????????

????:??qt????2020:????150??

???????????1????????????17? ??????????????17??????????????,???

??????

2024???????????????12?18?,???????????CNCERT?????????????????(

???????????????????

(?????)???????????????????

2024?????????????8?????????????19?????????,??,??????????/?????2024??????????????8??????????21??,???????/???????

(????????)??????????????????????????????

2024???????????????????????????8???????????21?12?????????,????????????????,?????????????????????,???,?/xxx/xxxx?flag=syn_user_policy??????????????????,???????????/xxx/xxxStats?

(?)???

2024???????????????????11?6??????2024????11??????8?2024??11?16???,?????276?????????????????????????????

????????????????????????????????????

(?)?????????????

????????IP?,??????????,???,??????????????????????,???????????????

(?)?

2024?11????6???????????11??????????16?,???????????????3????IP??????????????,????,????,??????????????????????????,??????????????????????????????????,?????????????????4.98GB?

??????????????????

(??????????)????????????????????????

?????,?22?????????????8????????????????????????????,?10?????????????????20??????????,?,??

(??????????????)????????????????????

????????????5?IP???????????????,?,?????????

(?)???????????????????

??,?????????????????????????,??

????????????,??,??

(?)?

???????,?,???????,?????276??,????????????????????,????????????????????????????

????????????????????????????IP??????

?

2024??????????????????????12????18???????????,?CNCERT??????????(

???

(??????)?

?Exchange???2?Exchange??????,??????,????????,?????????????????

(???????????????????)?????????

????,???2???,???????????????????????,???????????????????,?/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,???????????????????????????????????????????????,?,?????????????????????????????

(???????????????)?????30???????????

?,????????????,??????????????,????SSH?SMB????30??????????????;?,?????????????????????????????????????????????,?????????websocket+SSH??????,??????????????????,??????????WeChatxxxxxxxx.exe??2????PIPE???????????????,????????????

??????????????????????

(????????????????)???????????????????????

????,?????????,??????????????,?,???????????????????????,???????

(?????????????)???????????????????????????

?3???????,?????????????????????,2023?5????2?,?(95.179.XX.XX)??????????,??????????,???????????????????,??????,??????????“?”?“?”?“???????????????”?“???????????????????????(????+?????????)”?“???????????????????IP???”?“????????????”????????

(?????????????)?

??????????????,??????????????????????,2023????7???????????26?,???????????(65.21.XX.XX)?????,??????????????????????,????????????????,?,?1.03GB??????,????“???”??????“tip4XXXXXXXX.php”?

(?)?

??,????????????????,????????????,??????????????????SSH????????,?????,??

??????????????????????????????

(??????????)??????????????????????????

?????,?????22??????8????????,?10??20?,??????????????,???????????????????????

(?????????)??

2023???????????????????????5?????????????????????2023????10?,?30???????????????,?????????????IP??????????????????,???

(?????)???

??2??PIPE??????????“c:\windows\system32\”????,??????????????????.net???????????????,???????,????KB,???TLS????????????????????????????????????????????,???????https?,???????????websocket+SSH??,??????????

????????????????????????IP????????????

???????:??