???????????????????????:?????????

????:??????:??????

??????1?17?????????????? ???????????????17?????,???????????

?????????????

2024???????????????????12????18???????????,???????????????CNCERT?(

?????

(????)???????

2024???????????8?????19????,?,???/??2024??8?21??????????????????,?????????????????????????????????/??

(?????)???????????????

2024???8???????????????????????21????????12??????????????,????????????????????????????,??????,???????????????????????????,??????????????????????????????????/xxx/xxxx?flag=syn_user_policy??,???????????????????/xxx/xxxStats?

(?????????)????

2024?11??????6?????????2024???????????????????11????8?2024???????????11?16?,????????276???????????????????????

????

(??????????????)????

????????????????IP???????,?????????,????,?,???????????

(?)?????

2024?11???????6?????????????????????11?16??????????,???????3????IP????????,???????????????????????????,??????????,?????????????????,????????,????????????4.98GB?

??????????????

(?)??????????????????????

?????????????????,?????????????22??????????????????8?,????????????????????????????10????20?,???????????,????????????????????????????

(??????????)????????????????????????????

???????????????5???????????IP??????,?,???????????

(?????)?????????

?,?????????,???????????????

??????,??????,??

(?)???????????????????????????

????,??,??,?????276?????????????,????????????????,???????????

???????????????IP???????

????

2024??????12??????????????????????18??????????,?????????????CNCERT?(

????????????

(?????)?

???????????????????Exchange???2???????????????????????Exchange??????????????????,?,?,??????????????????

(?????????)??

???????????????,?2????????????????,????????,????,????????????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????????,????????,???????

(?)?30??

????????????,?????????????,??????????????,?????????????SSH?SMB???????????????????30???????????;?,??????????????????????????????????????????????????????????????????????????????????????????????????,??websocket+SSH?????,??????????,????WeChatxxxxxxxx.exe???????????2??????????????????????PIPE???????????????????,???????????

?????????????????????

(?)?

????,??????????????????????????????,????,?,??,???????

(????????)?

?????????????3??,??????????????????????????????????????????????,2023?5????????????2?,????????????????????????(95.179.XX.XX)???????????????????????,??????,???????????????,?,???????????“?”?“??”?“??????”?“?????(?+??????)”?“????????????????IP????”?“????????????”??????????

(?)??????????????????????????????

??????????????????,???????????????????????????????????????,2023??????????????7???????????????????????????26?????????,??????????????(65.21.XX.XX)?????,?,?,??,?????????1.03GB????????????,????“?????”??????????????“tip4XXXXXXXX.php”?

(?)?

?,????????????????????????,??????????????,?????????????????????SSH??,????????,??

????????????

(??????????)???????????

?,??22?8????,?10??????????????20??????????????,???????????,??

(?)?

2023?5???2023???????????????10???????????????,???????30????????????????,?IP????,???????????

(????)?

?2???????????PIPE?????????“c:\windows\system32\”????????????,????????????.net??????????????,?,????KB,???TLS???????????????????????????????,??????????https????,????????????????????websocket+SSH?,??

????????????????????IP??????

??:????????????????????????