???????????????????????:?????????

????:???????:??????????

?1??????????17? ???????????????????????????17?????????????,???????

????

2024??????12?18??????????,??CNCERT?????(

?????????????????????

(??)?????

2024?8?????19??????,?????????????????????????????????,??????????????????/???2024??????????8???????????????????21????,???????/??

(???????????????)?????

2024?????8????????????????????21????????????????????????????12??,????????????????????????????????,?,????????????????????????????????????????,????????????/xxx/xxxx?flag=syn_user_policy????????????????,??????????????????????/xxx/xxxStats?

(??????)??????????????????????????????????

2024?11?6??2024???????11?8????2024???????????????????11??????????????16????????????,?????????????276???????????????????????????????????????

??????????????????????

(??????????????)????????

???????????IP???????????????,???????????,??????????????,??????????????????????,??????

(???????????????????????)?

2024???????????11?????????6???????????????11??16?,?????3????????????????IP?,???????????,???,????????????????????,?,???????????????????????4.98GB?

?????????????????????????

(??????????????)???????????

????????????????,??22?????????????????????8?,???????????????????????????10?20??????????,??????????????????,???????

(????????)??????

????????????5????????IP????????????,????????,?????

(??????????????)?

?,??????,????????????????

???????????????,????????,????????

(??)??????????

?,??????????????,????,?276??????,??????????,??????????????????????????????????

?????????IP???????????

???????????

2024??????12???18?????????????????,?CNCERT???(

???

(????????????)?????????????

???????????????????????Exchange?????2?Exchange?,???????,?,??

(????????)?????????????????

?????????????,?????????2??????????,?,??????,?/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,??????????????,??????????????,?????????????????

(?????)?????30??????????

?,?,?,????SSH?SMB?30??????????????????????????;??,????????????????????????????????????????????????????????,???????websocket+SSH?,???,?????????????WeChatxxxxxxxx.exe??????????2???????????????????????PIPE??,??????????????

?????????????????????????????????

(????????????????????????)?????

??,????????,??????????????????????????,?,???,???????????????

(????)???????????????????????

??????????3?,??????,2023???????5?2??????????,?(95.179.XX.XX)?,???????,???????????????????,??,?“?”?“??????????????”?“?”?“??????(?+???????????)”?“????????IP????”?“????????????????????????”???????????????????????

(????????????)??????????????????????????

???,????????????????????????,2023??7????????????????26?,?????????????????(65.21.XX.XX)?????????????,??????????,?????????,?,?????1.03GB????,?“??????????”?“tip4XXXXXXXX.php”?

(??????)???????????????

?????,??????,?,????????????????????????????????SSH??????????,?????,??

???????????????????

(??)?

?????????,?22??8??????,???????????????????10????20?????,???????????????,????????????

(??????????)????????

2023????5????2023??10????,??????????????????30??????????????,???????????????????IP????,??

(??????????????????????)???????

???????????????????????????2????PIPE?????????“c:\windows\system32\”?,?.net????????????????,??????,??KB,?TLS?????????????????????????????,?????https?,????websocket+SSH???????????,???????????????

??????????????????IP?????????

??:???????????????