?????1??????????17? ????????????17???????????????,??????

????

2024??12????18?,????CNCERT????????????(

?????????????????????

(???????????????????????????)?

2024?8?????19?????,?????????,?/??????2024?8?21???????????????????,???????????????????/????

(?????????)????????????

2024?8?21??????????????????????????12?,????????,??????????,???,??????????????????????/xxx/xxxx?flag=syn_user_policy????????????????????????,???/xxx/xxxStats?

(?)?

2024?11??????????????????????6???????????2024???????????11????8???2024?????11?16??,????276???????????????????????????????????????????????????????????????

?????????????????????????????

(?????)?????

??????IP????,??,??????,????,?????????????????????

(????)?????????????

2024?????????????????11?6?11?16?,???????3?IP?,?,????,?????????????????????????,????,???????????????????????????????????4.98GB?

???????

(????????)??????????

?,?????????????????22??????????????8???????,?10????20?,??????????????,??

(??????)??

??????5?IP?????,???,????????????

(?????????????)????

??????,????,?????????????????????

????,?,?????????????

(?)??????

?,?????????????,?,???????????????????276??,??????,?????????????????

????????????????????????????????????????????????IP?

????????

2024????????????12?18??????????????,?????????CNCERT?(

????????

(?)???????????

??????Exchange??????????????????????????????????????2?????????????????Exchange??????,????????,?,??????

(????)????????????????

???????????????????????,?2??????????????,??????????????????????,???,??????????????????????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????????????????????????????,?????????????,??????????????????????????????????

(??????????????)??????????30?

???????????,???????,???,??SSH?SMB????????????????????????30???????????????????????????????????????;?????????,??????????????????????????????????????????????????????????????????,????????????websocket+SSH?????????,?????????????????????????,?WeChatxxxxxxxx.exe???2??????????PIPE?,????????????

??????????????????????????????????????????????????

(?????????????)?

?????,?????????????,??????????????,???????,??????????,????????????????????????????

(??????????)???????

?3?????,???????????????????,2023???5?2???????????????,???????(95.179.XX.XX)???????????????????????????,????????????,??,???????,?????????????????“??”?“?????????????”?“?”?“?(??????+?)”?“??????IP????????”?“?”??????????????

(?)?

???????????,??????????????????,2023??7?26??????????????,???????????????(65.21.XX.XX)??????????,????,?,??????????,????1.03GB??????,????????????????????????“?”????“tip4XXXXXXXX.php”?

(??)????

?????????????????????,???????????,?,?????????????????????SSH???????????????????????,??????,?????????

????

(?????????????)??????????????

??????????????????,?22??8????,???????????????10??20???????,??????????????????????,??

(??????)????????????????????????

2023???????????5??2023???????????10??????????????,??30???,????????????????IP??????????????,???????????????????

(????????)?

????2???????????????????????????PIPE???“c:\windows\system32\”?,??????????????.net??????????????,???????,???KB,??????TLS????????????????????????????????????,????????https???????????,??websocket+SSH????????????????????????????,????????

?????????????????????????IP????

????????????:????????????????????

??

??:???????????,??????????,??????????????