???????????????????????:?????????

????????????1?????????????17?????? ???????17?,??????????????

??????

2024???12???????????????????????18?,??CNCERT?????????????(

???????????????

(??????????)??

2024?????8????????19???????????,?????,????????/????????2024?8????????????????21??????,???????????/????

(?)?????

2024?????8??21????????12?????????????,????????,?,??????????????????,???????????????/xxx/xxxx?flag=syn_user_policy?????????????????????????????,?/xxx/xxxStats?

(??????????)????

2024??11???????????6???????2024???????????11?8?2024?11?????????????????????????????????16??,??????????276????????????????????????????????????????

??????????????????

(??)??????

?????????IP????,????????,?????????,??,????????????????????

(???)?

2024?11??6??????????????11???????????????16?,????????????3??????????????????????????????????IP??????????????,????,????????????????,?????????????????????????????,?????????????,?????????4.98GB?

??????????????????

(??)????

??,??22?8?,?10??????????????????????20???????????????????,??????????,???????????????????????

(??????????)??????????????????????

????5?IP???????????????????????,?????????????????,????????????????

(?????????)?

???,????????????????????????????,???

?????,?,????????????????????????

(?)?

?,???????????????,???????????,????????276??????????????????????????????,?????,????

???????????????????????????????????IP?????

????????????????????????

2024???????????????????????????12??????????????????18?????????,??????????????CNCERT???????????????????????????(

?????????

(??????????)???????????

????Exchange??????????????????????????????????????????2??????????Exchange???????????,?????????????????,??????,?????????

(???????????????)????????

?,???????????????2?????????????,???????,?????????????????????????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????????????????????,??,???

(???????????????)???????????30?????????????

???????????????????,???????,??,??????????????????SSH?SMB??????????30?????????????????????????????????????????????;?????,???????????????????????????????????????????????????????,?????????websocket+SSH?,???????????,?WeChatxxxxxxxx.exe??????????2?PIPE?????????,????????????????????????????

????????????

(?????)?

?,?????????????????????????????,?,??????????????,??????????????,?????????

(?)?

?3??????????????,?????????????????????,2023??5?2????????????,?(95.179.XX.XX)????????????,?,?????????????????????,????,????“???????”?“????”?“????????????”?“?(?????+?)”?“??????????IP??”?“????”???

(????)?????????????????

?????????????????????????????????????,??????????,2023??????????7?26?,???????(65.21.XX.XX)????????????????????????????,????????????????????,?,?,?1.03GB??????,??????????????????????????“?”?“tip4XXXXXXXX.php”?

(?)????

????????????,??????,?,?????????????SSH?????,???????????,????????????????

??????????????????

(???)?????????????????

????,??????????????22?????????????8??????????,????????????????10???20????,?????,?????

(?)??????

2023?5??????????????????????????2023???????????????????????10???????,?30???????????????,????????????IP?????,??

(?)??????????

???????2?PIPE??????????????“c:\windows\system32\”???????????,??????.net?,?,?KB,????TLS???????????????????????????????????????????,?https???????????????,?websocket+SSH?????????,??

???????????IP?