?????????:???????????????????????

??1??????????17? ??????17?,???????????????

??????

2024??????12?????18????????,???????????????????????????CNCERT??(

???????????????????????

(??????)?

2024????8????????19?,?,???/????????????2024?8?????????????21??????????,?????????/????

(?????)??????????

2024??????????????8???????21????12???????????????????????,?????????????????????????????????,???????????????,????????????????????????????????????,??????????????/xxx/xxxx?flag=syn_user_policy??,?????/xxx/xxxStats?

(????????)????????????

2024?11?6?????2024???????????11???8??2024?????????????????11?16??????????,???276?????????????????????????????????????

????????????

(?????)?????????????

?????????IP???????,?,??,????,?????????????????

(????????????)?

2024??11??????????????????????6????????????????11???????????????16??????????????,??????????3??????????IP?????????????????,??????????,?,??????????????????????????????????????????,?????,?????????????????4.98GB?

????????????????

(?)?

???????????????,??22????8????????,????????10?????????????????????20???????????????,?,???????

(??????????????????????????)?

?????5?IP??,???????????????????,??

(???????????)??

?????????????,???????????,??

?????????????,???????????,???

(?????????????)???

?????,??????????????????????????????,???,????????????????????????????276??,???????????????????,????????????????????????????

???????????????????????????????????IP?

?

2024??12????????????????????????18?,?????????????CNCERT??????(

??????

(??????????)???????????????????????

?Exchange????????????????????2??????????Exchange?,??,?????,?????????????????

(????)???

?,??????????2??????????????,?????????,????????,?/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,??????????????????????????????????,???????,???????????????

(????)???30????

??????????????????,??????,?,?????????????????SSH?SMB???????????????????????????30??????????????????????;??????????????,??????????????????????????????????????????????????????????????????,?????????websocket+SSH??????????????????,????????????????????????????,?WeChatxxxxxxxx.exe?????????????????????????2?PIPE?,??????????

?????????????????????????

(????????????)??????

???????????????,??????????????????????????????????????,???????????,???????????????????????,???????????????,???????????????

(?)????????????

??3?????,?????????,2023????????????????????5??2???????????,???????????????????(95.179.XX.XX)?????,??????,?,???????????,?????????????????“?????????????????”?“?”?“???????????????????”?“????(?+???????????????????)”?“?IP???????????”?“?????”??

(????)???????????

?????????????????????????????????????,??????,2023?7????26??????,???????(65.21.XX.XX)?,??,?,?,??????1.03GB?????,?“?”?“tip4XXXXXXXX.php”?

(?)?

?,????????????????,????,?????????????????SSH???????????????,????????,??????

???

(??????????????)?????????????????????

?,?22?8??????????????????,????????10???????????????????????????20?????????,??????????????????????,???????

(?)??????????????????????????

2023??????????????5?????2023?10???????????????,????30?,???????????????IP??,??

(????????????)???

?2???????????????????PIPE??????“c:\windows\system32\”???????,????.net????????,????????????????????,?????????????KB,??TLS??????????????????????????????????,??https?,??????websocket+SSH?,??

???????????IP?

?????:????????????????????