?????????:???????????????????????

????:???????:???????

?1???????????17??????????????? ?17????,???

??????

2024???????????12?18???????????,???CNCERT?????(

??????????

(??????????)?

2024????????8?19???,???????????????,?/??????????????2024?8??????????????????21????????,?/???????

(???????????)???????????????

2024??????8?21??????12????????,????????????????????????,????????????????????????,??????????????????????????????????,???????????????????/xxx/xxxx?flag=syn_user_policy??,????/xxx/xxxStats?

(??)????????

2024???????????????????11??6??????????????2024??????????????11???????????????????8???????????2024???11?????????16??????????????,??????????????276????????????????????????????????????????????

???????????????

(???????)??????????????????????????

??????????????IP?,??,?,????????????,????????????

(???????????????????)?????????????????

2024??????????????????????????????????11??????????6????11??????16?????,??????????????3????IP???????????????????,?????,??????,????????????????????????????????????,?,???????????????????4.98GB?

???????????????????????

(????)?????????????????????????????????

?,?22???????????????????????8??????,?10?20?,???????????,?????????????

(?)????????????

?5???????IP?,?,???????

(?)?

?,?????????????????????????,???????

???????????,???????,????

(????)????????????????????????

?,????????????,?????????????????,?????????276?????????,??????????????????????????,????????

????????????????????????????IP???????????????????????????

?

2024?12?18?????,????CNCERT???(

????????????

(?)?

???????????????????????Exchange?????2????Exchange?????????????,?????,??,??????????

(?)??????????

??????????????????????????,?2??????????????,????????????????,???????????????,??/owa/auth/xxx/xx.aspx??????????/owa/auth/xxx/yy.aspx,??????????????????????????????????????????,?????,????????

(???????????????)????????30???????????

?,??????,??????,??????????SSH?SMB?????????????????30????????????????????;?????????????,??????????????????????????????????????????????????,?????????websocket+SSH?,???,???????WeChatxxxxxxxx.exe?????????????2?????????PIPE????????,?????

?????????????????????

(???)?????????????

?,?????,?????,?????????,?????,???

(?)??

????????????????????????????3????,??????????????????????????,2023??????5???????2????,?????????(95.179.XX.XX)??,??????????????????????,????????????,??,?????“????”?“????”?“???????????”?“?(????+???????????????)”?“????????????????IP??????????????????”?“??”??

(?)?????

????????????????????????????,????????????,2023????????????????????????????7???????????????????????????26??????,?(65.21.XX.XX)?????????????????,?,???,?,?1.03GB?????,?“?????”??????????????“tip4XXXXXXXX.php”?

(?)?????????????????

??????????????????????,??,??????????????,????????????????????????????????????????????????????????SSH??,?????,??

????????????????????????????????

(?)????

???,?22??????????????8???????????????????,???????????????10???????????????????20?,?,??????????????

(??????????????????????)??

2023????????????5??2023?10??????????????,?30???,?IP??????,????????????????

(??????????)??

??????????2?PIPE????????“c:\windows\system32\”?????????,?.net????????????????,??????,????KB,????TLS?????????????????????????????????????,???????????????????????https?????,???????????websocket+SSH?,???????

????????????????IP?

????????????????????????:???