????:1????????:????????

2?????

3??????

4???500???????

5?????????

???1??????????17????? ??????????????17?,????

??

2024?12????18???????????????????,?CNCERT?(

?????????

(????)???

2024????????????????????????8???????????????????19????????????????????????,??????????????,???/??2024????????????????8???????????????21????,???????????????????????/????????

(?????????????)???????????

2024????8?21???????????????????12?????????,?????????????????????????,?,????????????????????????????,????????????????/xxx/xxxx?flag=syn_user_policy?????,?/xxx/xxxStats?

(?)????????

2024???????????????11?6??????????2024??????????11????8???????????????2024????11???????????????16?,?????????????????????276?????????????????????????????????

????????????????????????????????????????

(????????????????????????????)???????

??????????????IP?,?????,?,?,????????????????????????????

(?????????????)????

2024????????11??????6????????????11?16???????,?????????????????????????????????3??????????????IP?????,????????????????,???????????????????,????????,?????????,???????????????????4.98GB?

????????

(??)?

????,???????22????8????????,?????????????10????????????????????????????20???????,????,???

(?????????????????)?????????????????????

????????5???????????IP??????,???????????????????????????,??????????????

(??????????????????)??????????

???,??????????????????????,??

?,??????,???

(??????)???????????

?,??,?,??276????????,??????????????????????????,???????????????????????????????

????????????????????????????IP??

?

2024??????????????????????????12???????????????18???????????,?CNCERT?????(

????????????????

(??????????????)????

??Exchange????????????????2???????????????????Exchange???????????????,?,???????????????????,???????

(?????)???

??????,?2????,??????????,????????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,???????????????????????,?????,??

(??????????)?30?

??????,??????,?,???????????SSH?SMB?30?????????????????????????;??????????,????????????????????????????????????,??websocket+SSH??,???????????????????????????????????????,???????????????????????WeChatxxxxxxxx.exe??????????2?????????????PIPE?,????????????????????????????

???????????????

(????)??????????????????????

?,?????????????????????????????,????,?????,?????????,???

(???????????)?

?3?????????,???????????,2023??????????????????????5?2???????,????(95.179.XX.XX)?,??????,?,????,??????????“???????????????????????”?“????????????”?“???????????”?“????????????(???+?????????????????)”?“?IP??????????????????????????????”?“?”??

(???)????

????,??????,2023???????????????7?26?,????????(65.21.XX.XX)?????,???????????,????????,?,?1.03GB????????????????????????,????????????“???????????????”???????????????“tip4XXXXXXXX.php”?

(?)???????????

????????????????????,?????,??????,???????????????????????????????????SSH????,??????????,???????????????????

?????????????????????????????

(????????????????)??

?,?22?????????8???????,?10???????20?????,????????????,???????????

(?)?????

2023???????????????????????????5????2023??????????????10???,???30??????????????,??????IP??,???????????????

(????????????)???????????

?????????????2?????PIPE???????“c:\windows\system32\”????,?????.net?,?????????,????????????????KB,?TLS?????????????????????????????????,?????https??????????,??????????websocket+SSH??????????????,??

?????IP????????????

??:??