?? > ???? > ??

?????????:???????????????????????

????:2025-01-17 22:03:12 ??:????

????:????VX:????????

?1??????????17? ?17????,??

??????????

2024?????12?????18?,???????????CNCERT????????(

????????????????

(??????????)????

2024???????8??????????19??????????,?,??????/???????????????2024????????????8??????????????21????????????,???????/??????????

(????????)?????????????????????

2024??8????21??12????????,???????????????,???????????,??????,?/xxx/xxxx?flag=syn_user_policy??,?????/xxx/xxxStats?

(?????????????????????????????????)?

2024??11?6????????????????????????2024??????????????????????????11???????8?????2024????????11?16?,??????????????????276?????????????????????

?????????????????????????????

(????)??

??????????????IP??????,?????????????,???????,???????????????????????????,???????

(??????????????)??

2024?????11?6??11?16??????,??????????????????????????????????3?IP??,????,?,?????????????????????????,??????????????????????,??????????????????????????????????????????4.98GB?

????????????

(???????????????)??????????????????

????,?????22?8??????,?10???????????????????????20?,??????????,?????????????

(?)?

?5?????IP?,???????????????????,????????

(????)??????

???????????????????????,???????,??

?????????,????????????????????????,??

(???????)??????????????????????

????,???,??,?????????????276?,????????????????????????????,????????????

??????IP????

??

2024?12?18????????????,?????CNCERT?(

?????????????????

(????????????)??????????????????????????????

???????????????????Exchange?????????????????????????????2????????Exchange????,??????,??????????????????,????????????

(????????)?

???????????????,????????????????????????????2??,???????????????????????????,???????????????????????????????,????????????????????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,??????????????????????????????????????????????,????,???????

(?)??????????????30?

????????????????????,????,??????,??????????SSH?SMB???????30??????????????????;???????????,???????????????????????????????????????????????????????????????????????????,????websocket+SSH??????,????????????????????????????,??????WeChatxxxxxxxx.exe??????????????????2????PIPE?,??????

?????????????

(??)?????

??????????,???????????????????,?????????,??,?????????,??????????

(?)?????

?3?,?????????????????????????????,2023?5????????????2?,??????(95.179.XX.XX)???????????,???,?,????????,?“?”?“???????????????????????????”?“???????”?“??(????+???????????)”?“???????IP?????????????”?“?????”??????

(?)??????????????

??????,?????????????,2023????7????26?????????????????,??????(65.21.XX.XX)????,???,?,??,??????1.03GB??,??????????“????????????”???????????????????????“tip4XXXXXXXX.php”?

(????????????????????????????)?

??????????????????????????,???????????????????,???,??????????????????????SSH????????????????,???,??

????????????????????????????

(?)???

???????????????,???????????????????????????22?8?????,?10????????????????20?,??,???

(??????????????)?????????????

2023???????????????5?2023?10?????????????,???30?,????????IP?,???????????????????????

(?????????????)?????????????????

?2?????????????PIPE????“c:\windows\system32\”?,???????.net???????????????,????????,??KB,????TLS???????????????????????????????????????????????????????????????????????,?https?????,??????websocket+SSH?,????????????????

?????????????????????????????IP???????????

??:??

????

  • ????
  • ????