?????????:???????????????????????

??

?1???????????????????17? ????17??????????????????????????????,??

?

2024??????????????????12??????18??????????????,?????CNCERT??????????????(

?????????????????????

(??????????)?

2024??????8?????????????19??????,????????,?????????????/????????????????????2024??????????????????????????8??????????21?,?????????/???????????????

(?????)??

2024??8????????????21???????????????12?????????????,?????????????????????????,????,????????,?????????????????/xxx/xxxx?flag=syn_user_policy???????????????????????,?????????????/xxx/xxxStats?

(?)??????????????????????

2024???????????????????11?6???????2024??????11?8??2024?????11????????16????????????????,??????276????????????????????????????????????????????

???????????????????

(??)??

???????????????IP?,?,?????????????,????,?????

(???????????????)??????????

2024??????????????11????6???????????????????????11???????????????????16??????????????????????????,????3????????????????IP?????????,??,?,???????????????????????????????,???????????,????????????????4.98GB?

??????????????????

(????????)????

??,?22????????????8?,???10?20???????????????????????,????,??

(?)?

???????????5????????IP???????????????,??,????

(????)?????

????????????????????????,??????????????????????????????,??????????????

?,?????,???????

(??)??

?????,???,??,?276?,??????????????????????????,??????????????????

??????????????IP??????????????

??

2024?12?????18?,??CNCERT???????(

???????

(?????)??????????????

??Exchange?????????????????????????????2??????????Exchange???????,?,????????????????,??

(????)?????

????????????????????????????,???????????????????2?????,?,??????????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????,?,????

(??????????????)???30??????

?????????????????,????,????????,??????????SSH?SMB?????????30?????????????????????????????????;?,????????????????????????????????????????????????????????????????????????,?websocket+SSH???,???????????,??????????WeChatxxxxxxxx.exe???????????2????????????????????PIPE?,??????

?????????????

(????)?????????????????

????????????????,?????????,?????????????,???????????????????????????,??????????????,??

(?)???????

?3????,????????????,2023??5????2?,???????????????????????????(95.179.XX.XX)??????????,?????????,???????,??????,??“???????????????”?“????”?“?????????”?“???????????????????????(?+?)”?“?IP?????????????????”?“?”????????????????????

(?)????????????

????????????????,????????,2023?7????????????26?????????????????????????????????,????????(65.21.XX.XX)?,???????,????????????????,?????,???????????????1.03GB????????????,??????????????“???”?“tip4XXXXXXXX.php”?

(?????)??????????

?,???????????,?????????????????????,????????????????????????????SSH??????????????,??????????????????????,??

???????????????

(????)????

???????,??????????????????22?8??????????,??????????????10????????20??,?,??????

(??????????????????????????????????)????

2023?5?????????2023?10?,???????????????30??????,??????IP????,??

(????)??????

??????????2???PIPE?“c:\windows\system32\”???????????????????????,??.net????????????????????????????,????,?????????KB,???????????????????????????TLS?????????????????????????????????????????,?https??????????,????????????????????websocket+SSH??,????????????????????

??????????IP?

????????????????:????????????????

?????????

??????????????:????????????????????????????

????????