?????????:???????????????????????

?????1????17?????? ????????????????????????????17???????????????????????,??

????

2024???????????????????????????12??????????18???,????????????CNCERT??????????(

???????????????????????

(?)???

2024??8?19?,??????????????,????????????????/??2024?8?????21??,???????/???

(???????????????????????)??????????????????????

2024????????????????8???????????21???????????12???????,????????????????????????????????,?????????????????,?????,???????????????/xxx/xxxx?flag=syn_user_policy???????????????,??/xxx/xxxStats?

(??????????????????????)?

2024????11?6??????????????2024?????????11??8?2024?????11?16?????????,??????????????276??????????????????????????????????????????????????????????

???????????????

(????????????)?

?????????IP??????????,???????????,??????????????,?,??????????????

(?)??????????????

2024????11??????????6?????11?????????????????????????????????16???????????,??3????????IP?,???????????????,???????????,????????????????????????????????,?????????,????????????????????4.98GB?

???????????????????????????????

(?)????????????????????????

????,?22?8???????,??????10??20???????????,??????????????????,?????

(?)????

?5?IP??????????????,???????????????????????,???????????????

(????)?

???????????????,?????????????????????????,???

?????????????????,??????????,???

(?)??

????????,?,?,?276????,?????????????????????????,??????????????????????????????????????????

????????????????IP??

????

2024????12?????????????18??????????????????????????????????,?????CNCERT?(

???

(?????)??????????

??Exchange?????????????????????????????????2???????????????????Exchange?,?,????????????,???????

(?)??????????????????????

????,??????????????????????2???????,?,?????????????????,???????/owa/auth/xxx/xx.aspx????/owa/auth/xxx/yy.aspx,??????????????????????????????????????????,??????????????????,????

(?)???????????30?

????????,??,??,??????SSH?SMB??30??????????????????????????????????????????????????????????;??????,??????????????????????????????????????????,??????websocket+SSH???????????????????,????????????????,??????????????WeChatxxxxxxxx.exe???????2???PIPE?????????????????,??

??????

(???)?

???????????????,??????????????????,????,????????,?????????????,??

(??????)?????????????

??3??,?????????????????,2023??????5???????????????????2?,????????????????????(95.179.XX.XX)?????,???????????????,?????????????,?????,????????“??????”?“?”?“????”?“???????????????????(?+?????????)”?“?IP???????”?“???????????”???????????

(?????????????????)?????????

????????????,???????,2023?7????????26?????????,???????(65.21.XX.XX)?????,?,??????,???????,???1.03GB??????,???????????????????“?”????“tip4XXXXXXXX.php”?

(?????)???????????????????

???????,?,??????????,??????????SSH????,???,????????????????????

??????????????????

(??????????????)????

????????,???????????22?????????8???????,????10?????????????20?,??????,??

(?)???????????????????????????

2023?5??????????2023?????????????????????10????,?30?,??????????????????????????IP?,?????????????????

(????????????)????????????????????????

?2??????????PIPE?“c:\windows\system32\”??????????????????,????????.net?????????,?????,??????KB,??TLS????????????????????????????????????????,?https????????????,?websocket+SSH?,??????

??????????????????????????????????IP?