???????????????????????:?????????

????:????:????95?

???????1???17??????????????? ?17???????????????,??????????????????

???????????????????????

2024???????????12?????????????18???????,??????????CNCERT????????????(

????????????

(????)???????

2024???????????8???????19????,????????????,?????????????????????/?????????2024?????8?????????21??????,?/??

(??????)???????????

2024?8?21?????12?,??????????????????,?,????????????????????,?????/xxx/xxxx?flag=syn_user_policy??,????????/xxx/xxxStats?

(??????????)???????????????????????

2024??????????????11???????6??2024???????????11?8?2024??????????11??16?????????,???????????276??????????????????????????????????

?????????????????????????????????????????????????

(?)?

?IP????,?,??????,??????????????????????,????????????????????????

(??)?

2024?????11?????6?11?16????,?3?IP????,???????????,??????????????????,????????????????????????????,???????????????,??????????????????????4.98GB?

???????????????????????????????????????

(?)?????????????

???????????,???22?8?,????10????????????20????????,??????,???????????????

(?)??????????????

???????????????????5??????IP???????????????????,???????????,???

(?????????????????????????????????)?

???????????????,???????????????,??

???????????????????,??,??

(????????????????????????)???

????????????????????????,??,???????????????????????,????276??,??????????????????,??????????????????????

?????????????????IP?????????

??

2024???????????12??18??????????,????CNCERT?(

?????????????????????????????

(?)?????????

???????????????????????????Exchange????????????????????????????????????????????2?Exchange??????????????,?,?,??

(????????????????????????????)??????

?,?????????2????????????,???????????,??????????????,????/owa/auth/xxx/xx.aspx??????/owa/auth/xxx/yy.aspx,??????????????????,??????????????????????,??

(?????????)??????????30????????

????,?????????????,?,???????????????SSH?SMB?????30??????????????????????????????;??????????????,??????????????????????????????????,?????????????websocket+SSH??????????????????,?????,?WeChatxxxxxxxx.exe??2???????????????????PIPE????,??

????????????????

(???????????????????)?????

??,?????????????????,?,????,????????????????????,??

(?)?

????3?,???,2023????????5??????????????????????2?,???????????????(95.179.XX.XX)?????,??????????,??????,?,???“?????????????????”?“?”?“?”?“??????????????????????????(?+?????)”?“??????IP???????????????”?“?”??

(????)?

????????????,???????,2023?????????????7???????26???????????????,????????????????(65.21.XX.XX)????,?????,?????,????????,??????????????????1.03GB???????????,???“??????”??????????????“tip4XXXXXXXX.php”?

(???????????????????????????)??????????

?,????????????????,??????,????????????????SSH????,???????????????????????????,?????

???????????????????????????????????????

(?????????????)?

???????????????????,?22????????????????????????8?,?10???20???,???,??????????

(?????????????????)???????

2023?????5???????2023????10?,?30??????,????????????????IP??,???

(???????)?????????

?????????????????2?PIPE??????????????????????????“c:\windows\system32\”?,?????????????????.net??,?????????????????????,???????????????????????KB,??????????????TLS?????????????????????????????????????????????,??????????https????,?websocket+SSH??,??

???????????????IP??????????????

????????????????????????????:??