????:1???3??400?????:?????????

2??????????

3??????

4??????????

5?????600??

?

2024????????????????12??????????????????????18???????????????????????????,????CNCERT???????????(

???????????????????

(?)????????

?Exchange???????2?Exchange?????????????????,??????????,??,???

(???????????)?

???????,?2???????,?,????????,???????????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,????????????,???????????????????,??

(?)??????????30???

?????,?,?,???????????????SSH?SMB??30???????????????????????;???????????,??????????????????????????????????????????????????????????,????????????????????????websocket+SSH?,??????????????????????????,?????WeChatxxxxxxxx.exe???????2?PIPE????????,???????????????????

????????

(??????????)?????????????????

????,??????????????????,?,?,????????????,??????????

(???)?

??????????3?,??????????????????,2023???????5?2????,????(95.179.XX.XX)???????,?????????,??????????????,?????,?????“?”?“??????????????????????????????????”?“?????????????”?“???????????(?+??????????????)”?“???????????????IP??”?“????”??????

(????)???

???????,??????????,2023?????????7??????????????????????????????26??????????,????(65.21.XX.XX)?????????????,??,??????,??????,????????????1.03GB???,?????????????????????“??????????????????????????”?“tip4XXXXXXXX.php”?

(?)????

??,?,???????????,????????????SSH?????????????,????,???

???????????????????????????????

(?)??????????????????????

?,?22??????????????8????????????,??10?????20??,????????????,??????????????????????????????????

(?)????????????????

2023??????????????5?2023???????????????10?????,????30???????????????????????????,?IP????,???????????

(????????????????????)????

?2?PIPE??????????“c:\windows\system32\”?,???????????????????.net?,????????,???????????????KB,?TLS???????????????????????,???????????????????????????https???????????????????,????????????????websocket+SSH?,??

???????????????????????????IP?????????

?

2024????????????????????????????12?????????18?,????????CNCERT????(

?????

(???)?

2024??????????????8???????????19??????????,???????????????,?????????????????/??2024?????????????????8???????21???????,?/???????

(?????????)?????????

2024?????????????8??????????21??????????????????????12???????????????????????,????????????,????????,??????????????????,?????????????/xxx/xxxx?flag=syn_user_policy??????????????????????,?/xxx/xxxStats?

(?)?

2024?????11?6?????????????????????????2024????????????11????????????????8?2024????11????????16???????????????????????,?????276???????????????????

?????????????????????????

(??????????)????

??????IP???????,?,????????????????????,??????????????????,????????????????

(?)?

2024???????????11??6?????????????11????????????????16??????????,?3???????????????IP??????,???????????????????????,????????,???????????,???????????????????????,?????????????????????????????????4.98GB?

????????????????????

(???)??????

??,?22??????????????8???????????,???????????????10?????????20??????,????????????,???????

(???????????????????)????????????????????????????

???????????????????5??????????????IP??????,????,?????????????????????????

(?????????????????)???

??????????????????????,????,??????????????

??????,?,???????????????

(???)???????

???????,???????????,??????????,?276?,?????????????,?????

???IP??????????????

??????:??