?1??????????????17??????????? ??????????????????????17?,?????????????????

??

2024????12??????????????????????????18????,????CNCERT?????????????(

????????

(????????????????????????)??????

2024??????????8???????????????19???????????,???????????????,???????????????????????/???2024???????8?21??????????,????????/?????

(?????????????????????????????????)???????????????

2024?8??????????????????????21????????12?,???????????????????????????????????,?????????????,???????????????,?/xxx/xxxx?flag=syn_user_policy???????????,??/xxx/xxxStats?

(?)???????????????????????

2024??????11????6????????????2024??????????11????????????8???????????????????????????2024?11???????????16?,???????276?????????

????????????????????????????

(????????????????)???????????????

?????????????????IP?,?,?,????,???????????????????

(??????????)??????????????

2024?11?????????????6????????????????????????11??????????????16?????????????????,??????????????3????????IP?,????,???????,??????????????????????????????????????????,??,????????????????????????????????4.98GB?

??????????

(?????????)?

??????????,?????????????22?8?????????????????????,???????????????????10?20??,?,?????????????????

(???????????)???

???5?????IP????????????,??,??????

(?)???????????

???,???????????????????????,???????????

?,??????????????,?????????

(?)?????

????,??????????,?,???????????????????????????276??????????????,????????????????????????????????????,???????????????

??????????IP?

?

2024?????????12??????????????????????18?,?????????CNCERT??????????????????????????(

???????????

(????)???????????????

????Exchange????????????????2?????Exchange?,???????????????,??????????,???????????

(???????????)????

?,?????2???????,?,???????????????,???????/owa/auth/xxx/xx.aspx???/owa/auth/xxx/yy.aspx,??????????,?????,????????

(?)??????30????

?????????????,?????????,??????????????,????????????SSH?SMB????30????????????????????????????;??????,?????????????????????????????????????????????,?websocket+SSH??????????????,??????????????????,?WeChatxxxxxxxx.exe???????????????2????PIPE??,????????????

??????????????????????????

(???)???????

???????????????????,???????????,?,???????????,????????,???????????

(?)?????

?3?????,????????????????????????????,2023??5?????2?????????????????,?????????????(95.179.XX.XX)?,?,?,????????????,?“??????”?“??????”?“???????????????????????”?“????????????????(???????????????????+??????????????)”?“??????????IP????????????????????????”?“??????”?????????

(?????????)????

????????????????????????????????????????,????,2023?????????7???????26????????????????????????????,?(65.21.XX.XX)??,?????,??????,?,?1.03GB??????????????????????,?“??????”????“tip4XXXXXXXX.php”?

(?????????)????????

??????????????????????????????????,??????????????,??,?????????????????SSH???,?,???????????????

??????

(???)?????????????

???????????????????????????,?????????22?????????????????8???????????????????,????10??????????20?????????,????,??

(?)???

2023????5???????????2023??????10?,???????????30?,????????????IP??????,??

(?)??????

?2????????????????????????????PIPE?“c:\windows\system32\”????????????????????,???????????????.net??,?,?KB,????TLS??????????????????????????????????????????,?https?,??????websocket+SSH?,???

????IP????

???????????????????:??

??

??:???????????,??????????,??????????????