????:2025-01-17 22:03:12 ??:????
????:????VX:????????
?1??????????17? ?17????,??
??????????
2024?????12?????18?,???????????CNCERT????????(
????????????????
(??????????)????
2024???????8??????????19??????????,?,??????/???????????????2024????????????8??????????????21????????????,???????/??????????
(????????)?????????????????????
2024??8????21??12????????,???????????????,???????????,??????,?/xxx/xxxx?flag=syn_user_policy??,?????/xxx/xxxStats?
(?????????????????????????????????)?
2024??11?6????????????????????????2024??????????????????????????11???????8?????2024????????11?16?,??????????????????276?????????????????????
?????????????????????????????
(????)??
??????????????IP??????,?????????????,???????,???????????????????????????,???????
(??????????????)??
2024?????11?6??11?16??????,??????????????????????????????????3?IP??,????,?,?????????????????????????,??????????????????????,??????????????????????????????????????????4.98GB?
????????????
(???????????????)??????????????????
????,?????22?8??????,?10???????????????????????20?,??????????,?????????????
(?)?
?5?????IP?,???????????????????,????????
(????)??????
???????????????????????,???????,??
?????????,????????????????????????,??
(???????)??????????????????????
????,???,??,?????????????276?,????????????????????????????,????????????
??????IP????
??
2024?12?18????????????,?????CNCERT?(
?????????????????
(????????????)??????????????????????????????
???????????????????Exchange?????????????????????????????2????????Exchange????,??????,??????????????????,????????????
(????????)?
???????????????,????????????????????????????2??,???????????????????????????,???????????????????????????????,????????????????????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,??????????????????????????????????????????????,????,???????
(?)??????????????30?
????????????????????,????,??????,??????????SSH?SMB???????30??????????????????;???????????,???????????????????????????????????????????????????????????????????????????,????websocket+SSH??????,????????????????????????????,??????WeChatxxxxxxxx.exe??????????????????2????PIPE?,??????
?????????????
(??)?????
??????????,???????????????????,?????????,??,?????????,??????????
(?)?????
?3?,?????????????????????????????,2023?5????????????2?,??????(95.179.XX.XX)???????????,???,?,????????,?????????????????????????????????????????(????+???????????)????????IP?????????????????????????
(?)??????????????
??????,?????????????,2023????7????26?????????????????,??????(65.21.XX.XX)????,???,?,??,??????1.03GB??,?????????????????????????????????????????????tip4XXXXXXXX.php?
(????????????????????????????)?
??????????????????????????,???????????????????,???,??????????????????????SSH????????????????,???,??
????????????????????????????
(?)???
???????????????,???????????????????????????22?8?????,?10????????????????20?,??,???
(??????????????)?????????????
2023???????????????5?2023?10?????????????,???30?,????????IP?,???????????????????????
(?????????????)?????????????????
?2?????????????PIPE????c:\windows\system32\?,???????.net???????????????,????????,??KB,????TLS???????????????????????????????????????????????????????????????????????,?https?????,??????websocket+SSH?,????????????????
?????????????????????????????IP???????????
??:??????