???1?????17???????????????? ????????17??????,?????????????????????????

????

2024?12???????18?,?????CNCERT??????(

???????????????????????????????????????

(?)????

2024????8????19?????,???????????????,??????????????/??2024???????????8???????21?,?/????????

(????)???????????????

2024?8???????????????21??????????12?,??????????????,???????,??????,?/xxx/xxxx?flag=syn_user_policy??,??/xxx/xxxStats?

(??????????)???????????????

2024???????????11???????????????????6???2024????11?????????????????8??????2024????11?16???????????????????????,??????276???????????????????????????????????????????????????

????????????????????????????

(?????????????????)?

???IP??????,?,?,?,???

(???????????????????????)???

2024??????????????11?6?11????16???,????????3???????????IP??,???????????????????????,????,???????????????????????????,?,?????????????????4.98GB?

????????????????

(?)?

??,?22??????????????8???,???10?20???,?,??????

(?????????)??

??????????????????????????5??????????IP???????,??????????????,??

(?????)??????????

?,???????????????????????????????,????????????????????????????

????????,?,????????????????????

(???????)?

????,??,?,????????????276????????????????,????????????????,????????????????????????????

??????IP??????????????

??????

2024??????????12?18???????????????????,??CNCERT??????????????????????????????????(

???????????????????????????????????????????

(?????????????????)??????

??????????????????????????????Exchange??????2????Exchange???????????????,?,???????????,??

(??????????????????????)?

?,??2?,????,???????????????????????????????,????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????????????????????????????????????????????????????????,?????????,??????????????

(?)??????????30????

?,??????????????,??????????,?SSH?SMB???????????????30????????????????????;????????,????????????????????????????????????,?websocket+SSH?????????????,?????????,?????WeChatxxxxxxxx.exe??2??PIPE?,??????????????

???

(??)???????

????????,????????????????????????,??,?????,??????????????,???

(?)?

??3?,?????????????????,2023???????????????5???????????????????2?,????????????(95.179.XX.XX)????????????????????????????,??,?????????,?????????,????????????“??????????????????”?“??????????????”?“??????????????”?“????????????????????(?????+??)”?“???????????????????????????IP?”?“???????????????????????”?????

(??????)????

????????????????,??????????,2023???????????7????????26?,????????????????????(65.21.XX.XX)????????????,?,???????????????????,??,????????????1.03GB??,????“????????????”?“tip4XXXXXXXX.php”?

(??????)??????

?,?????????????,??????,?????????????????????????????????SSH????????????????????????????,???,??????????????

????????????????????????

(??????????????????)???????????

????????????????,?????22?8?????,???????????????10????????20?,??????????????????,????????????????

(?????????????????????)??????????????????????

2023?5?????2023?10??????,?30?????,??IP??,????????????

(??????????????????????????)?????

???????????????????2???????PIPE??????“c:\windows\system32\”?????????,????????.net?????????,??????????,????KB,?????????????TLS????????????????????????????????????????????????????????????,????https?,???????????websocket+SSH?,??????????????????

??????????????????IP???????

??????:??????????????

??

??:???????????,??????????,??????????????