?????????:???????????????????????

???????1??17??????????? ??????????17??????,???????????????????????????????????

??????????????????????

2024?12?18??,??????CNCERT????(

????????????????

(????)??????

2024??????8?19?,?????,?????????????/???????????????2024?8?21??????????????,?/?????????

(?)?

2024??????????????????????????8????21?12?????,???????????,?,??????????????????????????,??????????????/xxx/xxxx?flag=syn_user_policy?????,????/xxx/xxxStats?

(??????????????????????????)??

2024???????????11????????????????????6??????2024????????????11????????????8?2024?11?16?,??????????276????????????????????????

????????????????????

(?????????)??????

???????????????IP??????????????????????,?????????,?????????????????????,?????,????

(???????)???????????????????????

2024??????????11?6?11?16????????????????????????,?????????????????3??IP????????????,???????,??,?????????????????,?????????,??????????????????????????????????????????4.98GB?

???

(????????????????????????????)???????????

????,?????????????22??????8?,?10????20?,?,??

(????)???????

??????????????5????IP???????????????,??????????,????????????

(???????????????????)?

?,???????????????????????????????,??????????????

??????????,??????????????????,???????????????

(?????????)????

?,?????????????,??????????????,???276?,????????????,?????????????

????????????????????????IP?

??????????????

2024???????????????12?????????????18?,?CNCERT???????(

???????????????????????

(??????)???????????????????

?????Exchange????2????????Exchange????????,?????,???????????????????,??

(?????????????????)?

??????????,???????????????2???????????????????????,????????????????????????????,????????,???????????/owa/auth/xxx/xx.aspx????????/owa/auth/xxx/yy.aspx,????????????????????????????????,???,???????

(???????????????)????30??????????????

??????????????????????,?,?????,?SSH?SMB?30?????????????????;?????????????,???????????????????????????????????????????,?????????????????websocket+SSH?????,????????,???WeChatxxxxxxxx.exe?????????????2?PIPE????,??

??????????

(????)???????????????????????????

????????????????????????,??????????????????????????????,???????????????????????,????????,???????????????????,???

(?????)?????

????3??????????,?????????????,2023??????????????5???????????????2????????,?????????(95.179.XX.XX)??????????,??????,?????????????????,???????????????????????,???????“?”?“??????”?“???????????????????”?“??????????????????????(??????????????+?????????????)”?“?IP?????????”?“??????????”??????

(????????????????????????)?

?????????????????????,????????????????????????????????,2023????7??????????????????26????????????,?(65.21.XX.XX)?????????,??,??????????????,?????,?1.03GB??????????????,?“?”?“tip4XXXXXXXX.php”?

(???????????????????)???????????

??????????,???,??????????,??????????????????SSH?,????????????,?????

????

(?)???????

?????,????22?8????,????10??????20????????????,?,??

(????????????????)??????

2023????5?2023??10?????????,????????????30?,?????IP???????,????

(????????)??

?????????????????????????????????2???????????PIPE?????????????????????“c:\windows\system32\”???,?.net??,???,?KB,??TLS???????????,???????????????????????????https?,??????????????????????????????websocket+SSH???????,????????????

?????????????????????????????IP???????????????