???????????????????????:?????????

????:????????:??????wx

???1?????????????????17???? ??????17?????????????,????

?

2024??????12????????18?,?CNCERT???????????????????(

??????????????????

(?????????)????

2024????8?19????,????,?????/??????2024??????8?????????????21?????,??/??????

(??????)???????????????

2024????8???????????????????21?12?????????,????????????????,????,???????????????,?/xxx/xxxx?flag=syn_user_policy??????????,?/xxx/xxxStats?

(??)???????????????

2024??11???????6???2024???????????????????????11?8???????2024??11??16?,?276????????????????????????????????????????

?????????????

(????)???????

??IP?,?????,??????,????,????????????????

(?)???????????????????????

2024?11?????6??????????????11????????????????16?,??????3??????????????IP??????????????????,?????,?,????????????????,??????????,?????????????????????????????????????????????????????????????????????4.98GB?

???

(????????)??????????

??????,?22?8????,???????????????10????????20?,??,???????????

(?????????????????????)?????????????

?5?IP???????????,?,?????????????????????

(?)?

?????????,??????????????????????????????????,????????????????

?????????,??,????????????

(???)???????????????

????????????,????,??,?276???????????,??????????????????,???????????

?????????????????????????????IP?????????????

?

2024???????????????????????????12????18?????????,???????????????????????CNCERT????(

????????????????????

(???????)?

?Exchange????????????????????2????????????????????????????Exchange???????,???????,?????????????????,????

(?)??????????????????

?,?2?,?,????,??????????????????/owa/auth/xxx/xx.aspx????????????????/owa/auth/xxx/yy.aspx,??????????????????????,?,????????

(??)???????????????????30????????????????????????

?????????????????????,????????????????,?,??????????????SSH?SMB?????30????????????????????????????????????????????;?????,??????????????????????????????,??????????websocket+SSH?????????????,??????,??????????????????????WeChatxxxxxxxx.exe???2??????????????PIPE???????????????????,?????????????

???????????

(????????????????????????)????????????????????????

????????,???,??????????????????????,??????,??????????????,???????

(???????????????????????????)?

???3?,?????,2023????5???????????????2?,???????????????????(95.179.XX.XX)???????????,???????????,?????????,?,????????????“?”?“??????”?“??????”?“??????????????(???+??????)”?“????IP?”?“??????????”???????????

(??????????????)????????

?????????????????,????????,2023?????????7?26????????????????????????????,????(65.21.XX.XX)???????????????????????,??????,?,??????????????????????,?1.03GB???????????,?????????????????????????????????“??????????”??“tip4XXXXXXXX.php”?

(?)????????????

??????????????????????????,??????????????,??????,?????????????????????SSH??,?,??

?????????????????

(???????????????????????)?????

?,????????????????????22????????????8???,???????????10?20??????????????????????????,?,????????????

(????????)?????????????

2023?????5?????????2023?10???????????????????,????30???????????????????????????,?IP??????????,????????????????????

(??????????)??????????????

??????????????????????2?PIPE?????“c:\windows\system32\”??,??????.net?????,???????????,?KB,??TLS???????????????????????????????????????????,???????????????https?,???????????websocket+SSH?????????????,?????

??????????????IP??????????

??:?????