?????????:???????????????????????

??

??????????????????????1???17???? ????????????????????????????17?,??

?

2024?12??18?,???CNCERT??????????????(

??????????????????????????

(?)??????

2024????????8???????????????19?????,?,?????????????/????????2024??8???????????21????????????????????????,?????????????/??

(?)?

2024?8???21?12?,???,?????????????????,?????????????,?????/xxx/xxxx?flag=syn_user_policy???????,??????????????/xxx/xxxStats?

(?)???

2024?11?6???????????2024???11????????????????8????????2024????????11?????16????,?276???????????????????????????????

??????????????????????????

(?)??????????????

????IP???????????????,?,??????????,??,??????????????????????

(??????????)??

2024?11????6??????????????11???????16?,?????????????????????3??????????????IP?,????,??,?????,?,?????????????????????????????????????????????????????4.98GB?

?????????

(?)??????????

????,???????????????????????22??8?,?????10?20???????,?,??

(??????????)???????????????

?5???????IP??????,??,????

(??????)??????????????

??????,???????????????????????????????????????,??????

?,??,??????????

(????????????????????????)?

??????????????????????????,???,???,????????????276?,???????????????????????????,???????????????????????????????

????????????????????IP?????????????

??????????

2024?????????12????18????????????,?CNCERT??????????(

?????????????????????

(?)????????

?Exchange??????????????2??????Exchange???????????????????,??????????,????,?????

(?????????????)????

?????,????2??????????????????,?,???????????????????????????,???????????????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,??????????????????????????????????,???????????????,?????????????????

(???????????)?30??????????????????????????????????

??????????????????????????????,???????????????????????,???,??????????????????????SSH?SMB??????30????????????????????????;???????,??????????????????????????????????????????????????????????,??????????websocket+SSH?,????????,????????WeChatxxxxxxxx.exe???????????????2??PIPE????????????,??

????????????????????

(?)??????

?,?????????????,??,?,????,???

(????????????)?????

????3???????????,???????????????????????????,2023?????5?????????????????2?????????????,????(95.179.XX.XX)??????,???????????????????????????,?,???????,????????????“?”?“?”?“?”?“???????????(???????????????????????????+????)”?“??????IP??”?“???????????????”??

(?????????)????????????

???????????????????,??????,2023????????7?????????26??????????????,????(65.21.XX.XX)??????????,?,????,?????,????????????1.03GB????????????????????????,?????????“??????????????????????”????????????????????“tip4XXXXXXXX.php”?

(?????????????????????????????????)?

??,???????,????????,?????????????????????????SSH?????,?,???????????????

????????????

(??)??

?????????,?22????8?,???????????????????10???????????????20???????????????????,???????,???????????????

(???????????)??????

2023?5??2023????????????????10?,???????????????????????30?,??????IP?,?????????

(??????)???????????

???????????2??????????????PIPE???????????“c:\windows\system32\”???????????????????,?????.net?,??????,??KB,???????????????????????TLS???????????????????????????????????????????????????????,???????????????https??????????????????????,?websocket+SSH???????,??????????????????

???????????IP?

??:?????????????????????????????

?????????

??????????????:????????????????????????????

????????