???????????????????????:?????????

??????????1??????????????????17???????????? ?????17?,????????????????????????

??????????????????

2024??????????????12??????????????????????????18?,?CNCERT?(

??????????????????????????????????????

(??????????)??

2024?8???????????????????19????????????????????????????,?,?/???????????????2024?8??????????????21?????????,??/????????????????

(?????????)???????????

2024???8????????21????12?,???????????,????????,?????????????????,???????????????????????????/xxx/xxxx?flag=syn_user_policy????????,??????????????/xxx/xxxStats?

(???)????????

2024??????????????11???????????6???2024?????11?8??2024??????????11?16?,?????276?????????????????????????????????????????

???????????????????????????

(?)?????????

????IP????,??????????,???????,???????????????,???

(???????????)?

2024???????????11??6????????????????11??????????16??????,???????????????????????????3?????????????IP??????,?,?,???,????????????????????,?????4.98GB?

???????????????

(??)????????????????

??????????????,????????????22??8??,????????????????10??????20??,??????,???????

(?)??

???????5?IP????????????,?,???????????????

(?)???????

???????,???,????????????????

??????????,?????,??

(?????????)??????????

?,?????,??????????,?276?,???????????????????????????,??????

????????????IP?

???????????????

2024??????12????????????????????????18????????,?CNCERT????????(

???????????????????????

(?)????????

?????Exchange?????2?????????????Exchange???????????,???????,?,?????

(????)??????????????

????,???????????2?????????????????,?????????????????,??????????????????????????????,????????????/owa/auth/xxx/xx.aspx?/owa/auth/xxx/yy.aspx,????????????????????????,??????????,?????

(?????)?30?

???????????????????????????,????,?????????????????????,???SSH?SMB????30????????????????????????????????????;??????,????????????????????????????????????????????????????????????????????????,??????????????????websocket+SSH??????????,??????,???WeChatxxxxxxxx.exe??????????????2??PIPE??????????????,??

????????????????????????

(????)???????????????

?????????????,??????????,??????,???????????????????????,?,???

(???????????)??????

????????????3?????,????????????????????????????????????????????????????,2023????5?2??????,??????????????????????(95.179.XX.XX)???????????,???????????????????,??????????,??????,????????“????”?“?”?“?”?“???(???????????+????)”?“??????IP?????????????”?“???????”???

(??????????????)?

?????,????????????????????????????????????,2023?????7????????26????,??????????????????????????????????(65.21.XX.XX)?,??????,?,?????????,?1.03GB???,??????“?????????”??“tip4XXXXXXXX.php”?

(???????)????????????

??,????,??????????????,?????????????????????????????????????????????SSH??,?????????,??

????????????????????

(?)?

?,???????????????????????22??8??????????????????????????????,????10????????????????????????????20?,?????,??????????????

(?)????????

2023???????????????????5?2023?10?,??????30?,??????????IP???????????????,??

(??????????????????????)???????????

?2?PIPE?????“c:\windows\system32\”?,?.net???????????????????????,??????????,???????????KB,?????TLS????????????????????????????????????????????????????,???????????????????https?,??????????????websocket+SSH?????????????????????,?????????????????????

?????????????????????IP?????