???????????????????????:?????????

??????????????????????1??????17?????????? ?????17???????,???????????????

?

2024?????????????12????18???????????????????,???????????????CNCERT??????????(

?????????????????

(??????????????????)?

2024???????????????????????8????19?????????????????????,????????????????,????/???????????????2024???????????8????????????21????,??/??

(????)?????????????

2024????8????21??????12???????????????????????,??????????????????????????,??,?????????????????,??????/xxx/xxxx?flag=syn_user_policy??,???????????/xxx/xxxStats?

(??????)????????????

2024????????????????11????6???????2024?????????????11????????????8???????????????2024?11?16?,??????????276?????????????????????????????????????????

??????????????????????

(?)????

???????????IP??????,?,????????????,?????,???

(????????)??????

2024????????????11?????????????????????????????????6?11???????????16?,????3????????IP?,??,?,????,?,?????????4.98GB?

?????????????????

(????????????????????????)????

????,?????????22?????8???????????????????????,?????10???20?????????????,?????????,??

(???)?????

?5??????????IP???????????,??????????????,????????

(??)??????????????

?,???????????????????????????????????????,????????

??????,??????????????,???????????????

(????????????????????)????

??,???,???????????????,???????????????276??????????,??????,?????????

?????IP??????????????????????

??????????????????

2024?????12?????18??????????,???????????CNCERT???(

?????????????????????????????????????

(?)????

?Exchange??????????????????2??Exchange????????????????????????,?????,?????,???????????

(???????????????????????????)???????????????????????????

?,???????????????????????????2????????,???????????????????,?????????,????????/owa/auth/xxx/xx.aspx???/owa/auth/xxx/yy.aspx,??????????????????????????????????????,???????????,???????

(??????????????????)?????????30?

?????????,?????????????????????,??,?SSH?SMB?????30????????????????????????????;???????????,?????????????????????????????????????,????websocket+SSH??????????????,??????,?WeChatxxxxxxxx.exe??2?????????????????PIPE?,???

??????????????????????????????????????????????

(????????????)????????????????

??,?????????????????,???????,???????,?,??

(???????????)?

?????????3???????????????????,??????,2023???????5?2?????????,????????(95.179.XX.XX)??????????,???????????,?,?,?????“?????????”?“????”?“?”?“????(?????????+????????)”?“???????????????????????IP??????????”?“?????????????????”?????????

(???????????????????)??????????

?????????????????????,?????????????????????????????????????????,2023?7?26?????,?(65.21.XX.XX)??,??????????????,?,???????,?????????1.03GB??,???????????????????“?”??????????“tip4XXXXXXXX.php”?

(?)?

?????????????,?,?,????????????????SSH????????????????,????????,????????

?????????????????????????????????????

(?)??

?????,?????????????????22?8?,?10????20???,?,????????

(??????????)?

2023?????5??????????????2023?10?,?30??,??IP????,???????

(????????????)??????????????????????????

???????2??????PIPE???????????????“c:\windows\system32\”?,?.net?,???????????????,???KB,????????????????????????????TLS?????????????????????????????????????????????????????????,???????????????????????https??????????????,?websocket+SSH??????????????,????

??????????????????????????????IP?

??????????????:???????????