?????????:???????????????????????

????:??????????:????????

?1????????17???????????????????????? ??????17???????????,?????

??

2024?????12????????????????????18????????????????,?CNCERT?(

????????

(??????????)??

2024????????????????????8??19?,?,?/????2024????????8?????21??????????????,???????????????/???

(???????????????????????)????????????

2024????8??????21?12???,???,?,????????????,?/xxx/xxxx?flag=syn_user_policy????????????????,???????/xxx/xxxStats?

(??????)???????

2024?11?????????????????????6???????????2024??????11??????????????8??????????2024?11???16???????????????????,???????????????????????276?????????

?????????????????????????????????

(???????????????????)?????????????????

?IP????,?????????????????,??????????????????????????,???,??????????????

(????????????)?

2024?11????6??????11???????????????16??????????,??3?IP????????,??,?????????????,??????????????????????????????,???????,?????????????????????4.98GB?

??????????

(??)?

?,???????????????22???????????8?,?10?????20??????????????,??????????????,????????????????????????????

(???????????????????????????)????????

?????5??????????IP???????????????,????,?????

(??)?

???????????,????????????????????????????????????,??

??????????,???????????????????????,????????????????

(????)??????????????

????,???????????????????????,?????????????,???276????????????????????????????,??????????????????????????,????????????????????????

?????????????????????IP???????????

???????

2024?????????12??????????????18????????????,??????????????????????CNCERT??????????????????????(

???

(????)?

???????????Exchange?????????2????????????Exchange??????,??,??????????????????,???????????????????

(???????)?????????

????,?2??????,???,??????????????????,?????????/owa/auth/xxx/xx.aspx???????????/owa/auth/xxx/yy.aspx,??????????????????????????????????,?,??????????????

(??)??30???

???????????????????????????,???????????,????????????,?SSH?SMB????30?????????????????????;????,?????????????????????????????,?????websocket+SSH??????,??????????,???????WeChatxxxxxxxx.exe??????2??????????PIPE??????,?????

???????????????

(?)?????

?,????????????????????????????????????????,????,?,???????????????????,?????

(???????????????)??

?????????3????????????????,?????????????????????????????????,2023??????????????5?????2??,???????????(95.179.XX.XX)?????,?,??,?,??????????????????????????????????“??????????????”?“??????”?“?”?“??????(??????????????+?)”?“?????IP?”?“?????????????”??????

(????????????????)???????

?????????????,???????????,2023??????7???????????26?,?(65.21.XX.XX)????,?,??????,??????????,?1.03GB?????????????????,?“?????”???????“tip4XXXXXXXX.php”?

(?)???????????????????

????,???????????????,?????????????,??????????????????????????????SSH????????,??????????????????????????,???????????

???

(??)?

?,???22?8???????????????,???????????????????10??20?????????????????????????????????,????????????????,?????

(??????????)????????????????????????

2023????5?????????2023??????????????10???,?????????30?????????,?????IP?,??

(?)???????????????????????????

???????????????????????2????????????????????????PIPE?????????????“c:\windows\system32\”??????,?.net???????,?,??KB,?TLS??????????????????????????????????????????????,?https??????,????websocket+SSH?,?????????

??????????????????????IP?????????????????

?????:???????????