????:1??????????:??????

2??????????

3?????????

4????????????

5?????

????1???????????????????????17???????? ???????17?,??

??????

2024????????????12?????18?,???????????????????CNCERT?(

???????????????????

(???????????????)??

2024??8??????????????????????19?,?,?????????????/??2024?8???????????????????????????21?????????????????????,?/????

(?)??

2024?8?21?12?,??????????,?????????,????????????????????????,?????????????????/xxx/xxxx?flag=syn_user_policy????????????,?????????/xxx/xxxStats?

(??????)???????????????????????????

2024????????11?6???????????????2024????11????????????????8???????2024?11????????16??????????,??????276????????????????????????????????????????????????

?????????

(?)??????

??????????????IP????,???????????????????,?,?,????????????

(??????)??????????

2024?11?????6??11???????????????16??????????????,??????????????????3?IP???????????????,??????????,??????,???????????????????????,???????????????,??????????????????????????????????????????????4.98GB?

???????????????????????

(??????????????????????)????

????????????????????????,??????????????22???????????????????8????????????,??????????????????????????????????10?20?,?,???????????????????????????

(???????????)????

???????5???????????IP??????????,?,?????

(?)?????????????????

?????????????,???????????????,??

??????????,????,??

(??????????????)??????????????????????

??????,?????????,????????????,???????????????????276?????????,???????????????????????????????,?????

????????????????IP????

?????????????

2024?12???????????18?,?????????CNCERT?(

??????????

(??????????????????)????????

?????????????Exchange?????????????????2??????Exchange???????????????????????????,??????????,?,???????????????

(???????????)??????????

???,?????????????2??????????????,?,??????????????????,???/owa/auth/xxx/xx.aspx?????????/owa/auth/xxx/yy.aspx,???????????????????????,?????,????????????????????????

(????)?30?

??????????????,???,??????,?SSH?SMB??????????????30????????????????????????????????????????????????????????????;?????,???????????????????????????????????????????,???????????websocket+SSH????,??????????,???WeChatxxxxxxxx.exe??????2????????????????PIPE?,??????

???????

(?)???????????????????

???????????,????????????????????????,?????,?,?,???????????????

(?????)??????

?3?????,?????????,2023????5???????????????????????2??????????????????,???(95.179.XX.XX)??????,??????????????????????????????,??????????,???????????????,?????????????“?????”?“???????”?“????????????????????”?“????????????????(??+??????????)”?“???????????????????????????IP???”?“?”????????????????

(????)??

??????,????????????????????????????????????,2023???????????????????????7??26????????????????,????(65.21.XX.XX)???????,??????????????????????????,???????????,??????????????,??????????1.03GB??,???“???????????????”???????????????????????“tip4XXXXXXXX.php”?

(??)?

???,???????????,????????????,????????????????????????SSH?,???????????????,???

????????????????????????

(??????????????)?

????????????,??????????22??8?????????,?????10?20?,?,??????????????????

(?)?

2023????5????2023?????10?,?30?,??IP????,????????????

(?)????

?2??PIPE????????????“c:\windows\system32\”??,???.net????,????,?KB,???????????????TLS??????????????????????????????????,????????https???????,?websocket+SSH??????????,??????

?????????????????IP???????????

??:??