?????????:???????????????????????

?????1???????????????????????17? ????17?????????????????????,???????????????

???????????????????

2024????????????????12?18??????,???????????CNCERT?(

????????

(?????????)?

2024?8???????????????19??,???????,?????????/?????2024?8???21??????????????,????/?????????

(??????????)?

2024???????????8??????????21?????????????12?,????????,?,?????????????????????????????????????,?????????/xxx/xxxx?flag=syn_user_policy??,???????????????????????????/xxx/xxxStats?

(??????????)???????????????????

2024???????????????????????????11?????6??2024??????????????????????????????????11?????????8??????????????????????2024?11??????????16??,??????????276?????????????????????????????

?????????????

(??????????????????????)????

??????????????????????IP????????????????????,?????????????????,?????,????????????????????,?????

(???????????)???????????????

2024???????11??6???????????11???????????16?????????,??????????????????????????3??IP?,????????????,????,?????????,?,??????????????????????4.98GB?

?????????????

(????????????)?????????

?,?????????????22??????8???????????????,?10???20?,?????,??

(?)?

?5??????????????IP????????,????,??

(???????????)???????????

??????,?????????????????????,??????????

??????????????,??,????????????????

(????)??

?,??,?,??????276??,?????????????????????,????????

??????????????IP????

???

2024?12?18?,????????????????CNCERT?(

?????????????????????????

(??????????????)?

??????????????????????????????Exchange???????????????????????????2??????????Exchange??????????????????????,???????????,??????????,??

(???????????????)?????????????????????

?,?????????????????2????????????????,?,?????????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????????????????????,??????,??????

(??????????????)?30???????

????,????????????????,????,?SSH?SMB?????30???????;?,????????????????????????????????????????????????????????????????????????????????????????????????????????????????????,???????websocket+SSH?????????,?????????????,???????????????WeChatxxxxxxxx.exe??????????????2???????PIPE???????????????????,????????????

???????????????

(?????????????)???????????????

????????????,????????????,???????????????????????????,??????????,????????,?????

(????????????)??

??????????3??,?????????????,2023??5?2????????????,?(95.179.XX.XX)?,?????????????????,???????,??????,????“?”?“???”?“?????”?“??????????(??+?????????????????????????????????)”?“??????IP????”?“???????????????”???????????????

(?)?????

????????????????????????????????,????????????,2023?7??????????????26????,????(65.21.XX.XX)??????,???,??????,???????????????????,?1.03GB??????????????,??????“?”???????????????????“tip4XXXXXXXX.php”?

(?)?

??,??????????????,???,?????????????????????????????SSH????????,????????????,????????

?????????????????????

(?)????????????????????????

?,????22??8??????????????????????????,????????10?????20?,????,?????????????????????????

(?)??????????

2023???5????2023??10?,???30????????????????????????,?IP?,?????

(??????)??????????????

????2?PIPE??????????????“c:\windows\system32\”?????????????,??.net?,?,?????????????KB,??????????????????TLS??????????????????????????????????????????,?https??????,????????????websocket+SSH??,????????????????????????

???????????IP?