????:1??????????:??98?

2??????

3???????

4???????

5???????

???????????????????1????????????????17?? ?17?????,????????????

??????????????????????

2024?12????18??????????,??????????????CNCERT?????????????????(

?????????

(????????)????

2024??????????????????????????????????8??19???????????????,??,??????????????/??2024???????????????????8????21?,?/?????????????????

(?????????????)??????

2024?????????????????????????????????8?21?????????12??????????,??????????,??????,???????????????????????????????????????,???????????????????/xxx/xxxx?flag=syn_user_policy??,??/xxx/xxxStats?

(?)???????????????

2024????????????11???????6??2024????11?8?2024??????????????11??16???,?????????276??????????????????????????????????

?????????

(?????????)????

?IP??????????????,????????,?????????,?????,??

(??????)?????

2024???????11?????????6???????????11???????????16????????,?3??????????IP????,????,??????????,??????????????,?,????????????????????????????????4.98GB?

????????????????????????????????????????????

(?)?

???????????,???????22??????8?,????????????????????????????10?20?,?,??

(???)?????

???????5?????IP???????????????,????,??????

(????)?

?,???????????????????????,??

????,?,???????????????

(??????????????????)???????????

?,??????,??????????,??276??,????????????????????????????????????????????????,?????????

????IP?

???????

2024????????12?????18???????????????????????,?CNCERT????????????????(

???????????????

(????????????)?????????????

??Exchange??????????????2??????Exchange????????????????????????,????,?,????????????????????????

(?)??????

???????????????,???2?,???????????????????????,??????????????,???????????????/owa/auth/xxx/xx.aspx??????????????????/owa/auth/xxx/yy.aspx,????????????????????????????????????????????,?,??

(??????)??????????????30??????????????

?????,?????????,??????,?SSH?SMB???????????????????30????????;????????????????????,?????????????????????????????????????????????????????????????????,??????????????????????websocket+SSH?,???????????????????????????,?????????????WeChatxxxxxxxx.exe???????????2?PIPE??????????????,???????????????

??????????

(???????????)?????

??,?????????????????????,???????????????????????????,?????????????,???????????,????????????????????????????

(????????)???

??3??,????????????????????,2023???????????????????????????5???????????????2??????????????????????????,??????(95.179.XX.XX)?,??????,??????????,?,???????“????”?“??”?“????????”?“?????????????(????????????+???)”?“?????IP????”?“????”??

(???????????????????)?????????????

???????????????????????,????????????????????????,2023???7?26??????????????,??????(65.21.XX.XX)?,?,?,??????????,????????????????1.03GB??,?????????????????“?”????“tip4XXXXXXXX.php”?

(???????????)?????????????????

??????????????????????,??????,????????????????????????????,????????????????????????????????????????SSH?????????????,???????,????????????

??????????

(????)????

?????????,??22????????????8??????????????????????????,?10?20??????????,????,???????????

(????????)?????

2023??5???????2023???????????????????10??????????,?30???????????,??IP?,??????

(?)?

????2?PIPE?“c:\windows\system32\”??,??????????????????.net?????,?,?????????????????KB,?TLS?????????????????????????????????,????????????https?,???????????????????websocket+SSH???????????????,???

????????????IP????????

??:??