???????????????????????:?????????

???????1?????17?? ?17??????,????????????????

??????????

2024??????12?18?,???????CNCERT?(

????????????

(??????)?

2024????????????????????????8?????????19?,?,?/??2024???????????8????21?,????????????/??

(?????????????????????)??????????????

2024??8?????21???12???,?????????????????,???????,????????,?????????????/xxx/xxxx?flag=syn_user_policy???????????????????????,??????????????/xxx/xxxStats?

(?)?????????

2024???????????????????11?6?????2024???????????????????11??8?????2024??????11??16?????????????,??????????????276??????????????????????

???????????????????

(??????)?????????????

????IP???????????,????????????????,??????????,?,??

(???????????????????????????)???????????

2024?11?????????6?????????11???????????????16??????,?3?IP?,?????????,?????,???,????????????,?????????????????????????????4.98GB?

??????

(??????)??????

??????????????,??????????22?????????????8???????????????,??10??20?????,?,????????????????

(?)?

??5????IP?????????????????,???????????,??

(??????????????????????)?

??,??????,??????????????????

????????,??????????????,????????????????????

(?????)??

????????????????????????,????,?,?276?????,???????????????????,???????

??????????????????????????????????IP????????????????

?

2024????????????????12?????18??????????????????,?CNCERT?(

?????????????????????????????????????

(??)????

??????????Exchange???????????2?????Exchange??????,??????????,???????????????????,??

(??????????????????????????????)?

???????????????????????,???????????2???????????????????,???????????,???????????,?????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,?????,????,????

(??????????)??????30????????????????????????

????????????????????,???????????????????????????,?,?SSH?SMB??30??????????????????????????????????;?????????????????,????????????????????????,???websocket+SSH??????????????,?????????,??????????????WeChatxxxxxxxx.exe??????????????2?????????????????PIPE?,???????????

???????????????????????????????????????

(????????????????????)????

?,?????????????,????????????,??????????,??,????????????????

(???????)???????

????3????????,???,2023?5???????????2???????,??????(95.179.XX.XX)?,????,????,???????????,?“??????????????”?“??????????”?“????”?“?(??+????????)”?“????????IP???”?“??????????”?????????????

(?????????)???????

??????????,????????????????????,2023?7???????????????????????????26?,?(65.21.XX.XX)????????????,??????????????,?,?,?1.03GB????????????????????????,??“???????????”????????????“tip4XXXXXXXX.php”?

(??)????????????????

??????,????,?,?????????????????????SSH???,?????,???????

??????????????

(????)????

??????????????????????????,?22???????????????????????8??????????,????????????10?????????????20??????,??,????????????

(?????????????)???????

2023??????????????????5??2023????????10????????????????????????????,??????????????30?,??????????????????????IP?,??????????????????????????????????

(????)??????????

??2???????PIPE?“c:\windows\system32\”???,??????.net??????????,????????????????,???????KB,?????????TLS???????????????????????????????????????????????????????,?????????????????????https???????????????????????,???????????????????websocket+SSH?,???????????????????????????????????

????????????????????????????????IP??????????????