???????????????????????:?????????

?1???????????????????????17?????????? ???????????17?,??????????????

?

2024?????????12????????????????18????????,?????CNCERT????(

???????????????????

(???????????????)?

2024????????????8????????????19?,?????,?/?????????2024??8??????21????,???????????????????/???????

(????????)?

2024??????????????8??????21????12????????,???????,??,?????????????????????????????????????????????????????,?/xxx/xxxx?flag=syn_user_policy?????,?????????????????/xxx/xxxStats?

(??????????????????????????????????)?????

2024??????????????11????6???????2024???????????11??????????????8????????????2024???????????11?16?,???????????276????????

??????

(?????)????

??????????????????????????IP???,?????????????,??????????????????,????????????????,?????

(?)???

2024??????????????????11?????????????6??????????????11???????????????????????16????????,?3????IP?,?,??,?????????,???????,?????????????????????????4.98GB?

???????

(?)?????????

???????,??22???8?,??????????????10?????20?,???????????,???????????

(?)?

?5???????????????????????IP??????????????????????,????????????????????????,???????????????

(??????????????????????????)?

?,??????????????????????,???

??????????,??,??

(??)?

?,?,?????????????????,????????276?,???,????????????????????????????????????

??????????????IP???????????????????????????

??????

2024?12?????????????????18???,??????????????CNCERT????(

??????????????????????????

(???????????????????)?

??????Exchange???????2???Exchange??????????,?,????????????,????????????????????????

(????)?????????

???????????,???????????2????????????,???????????????,?????????,?????/owa/auth/xxx/xx.aspx?????????/owa/auth/xxx/yy.aspx,????????????????????,???????????????????,??????????

(????????????)????????????????????30????????????????????????

?,?,??,?????????????????SSH?SMB????30????????????????????????;??,?????????????????????????????????????????????????????????,?????websocket+SSH???????????????,???????????????????,?WeChatxxxxxxxx.exe?????????????2??????????PIPE??,?????????????????????????

????????????

(????????)?

??????,???????????,???????????????,???????????????????????????,?,????????????????

(?)??????????

?3???????,??????????????,2023???????????????5???????????????????????????2???,?(95.179.XX.XX)??????????????,?,????????,???,?“??????”?“????????????????”?“??????????”?“??????????????(????+???????????????????)”?“?IP???????????????”?“??????????”??

(?)?????????

?????,???????????,2023??????????????7??26?????????????,??(65.21.XX.XX)????????,???????,?,??????????,????1.03GB??,??“?”????????????????????????????“tip4XXXXXXXX.php”?

(?)???????

????,????,?,?????????????????????????SSH???????????,??,????????????????????

??????????????

(?????????????)???????????????

?????????????,????????????????????22?????8?,?10??20??????????????,??????,??

(?)???

2023?????????????????????5????????????????2023???????????????????????????10?,????30???????????????,????IP?????????????????????????????????,????????????

(??????????????????????)???

???????????????2?PIPE?????????“c:\windows\system32\”?????????????????????,??????.net????,???????????????????????,???????????KB,????TLS?????????????????????????????????????,???????https??,??????????????????websocket+SSH?????????,??

???????????????IP??????????????